Splunk Enterprise

Can i have overlap on a Multi-series graph

robertlynch2020
Influencer

Hi 

I have the following graph.

It has an Area chart(s) and overlays(s). (In the image it has 2 but it can have more)

robertlynch2020_1-1759938839398.png

What people are looking for is to have one Area Chart with one overlay - When Multe Serice is turned on.

But if I turn on Multe Serice, I get this. Is it possible to get that using Multiservices mode?

robertlynch2020_0-1759938699376.png

Multiple graphs like this, but in Multe Serice mode.

robertlynch2020_2-1759939036596.png

Any help would be great - thanks.

  <panel>
      <title>Engine Count With MaxCount per Endpoint_Processing</title>
      <chart>
        <search>
          <query>| mstats avg("mx.grid.endpoint.engine.count") as count WHERE "index"="murex_metrics" span=10s AND "mx.env"="$mx_env$" AND service.name="$serviceName$" AND service.namespace="$serviceNamespace$" AND endpoint.name IN ($endpointName$) AND engine.state IN (processing) BY endpoint.name 
| join type=left endpoint.name 
    [| mstats latest("mx.grid.endpoint.expected_engine.count") prestats=true where index=murex_metrics AND "mx.env"="$mx_env$" AND service.name="$serviceName$" AND service.namespace="$serviceNamespace$" AND endpoint.name IN ($endpointName$) BY endpoint.name
    | stats latest("mx.grid.endpoint.expected_engine.count") as desiredCount by endpoint.name 
        ] 
| rename endpoint.name as EndPoint desiredCount as MaxCount 
| eval {EndPoint}_processing = count 
| eval {EndPoint}_MaxCount = MaxCount 
| fields - EndPoint count MaxCount | stats values(*) as * by _time</query>
          <earliest>$global_time_tok.earliest$</earliest>
          <latest>$global_time_tok.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">area</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.overlayFields">$Token_CHART_OVERLAY$</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="charting.lineWidth">2</option>
        <option name="height">483</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>

 

Labels (1)
0 Karma

robertlynch2020
Influencer

Hi

Thanks for the trellis tip  - But is there a way to group the overlay to the correct graph?

Below, I am looking for 2 graphs, which turn into 4. I have an overlay for each data set.

robertlynch2020_0-1759941470644.png

 

0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi,

Unfortunately enabling the multi-series mode on a visualization means that *all* series are split out, this includes the series intended to be an overlay. Whilst the UI will let you select an overlay series it will not appear as such and will instead be treated as a separate series.

The only way to get around this would be to use trellis mode instead of multi-series. This would allow you to still use the overlay as per the example below:

livehybrid_0-1759939950240.png

 

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...