Splunk Enterprise

Can i have overlap on a Multi-series graph

robertlynch2020
Influencer

Hi 

I have the following graph.

It has an Area chart(s) and overlays(s). (In the image it has 2 but it can have more)

robertlynch2020_1-1759938839398.png

What people are looking for is to have one Area Chart with one overlay - When Multe Serice is turned on.

But if I turn on Multe Serice, I get this. Is it possible to get that using Multiservices mode?

robertlynch2020_0-1759938699376.png

Multiple graphs like this, but in Multe Serice mode.

robertlynch2020_2-1759939036596.png

Any help would be great - thanks.

  <panel>
      <title>Engine Count With MaxCount per Endpoint_Processing</title>
      <chart>
        <search>
          <query>| mstats avg("mx.grid.endpoint.engine.count") as count WHERE "index"="murex_metrics" span=10s AND "mx.env"="$mx_env$" AND service.name="$serviceName$" AND service.namespace="$serviceNamespace$" AND endpoint.name IN ($endpointName$) AND engine.state IN (processing) BY endpoint.name 
| join type=left endpoint.name 
    [| mstats latest("mx.grid.endpoint.expected_engine.count") prestats=true where index=murex_metrics AND "mx.env"="$mx_env$" AND service.name="$serviceName$" AND service.namespace="$serviceNamespace$" AND endpoint.name IN ($endpointName$) BY endpoint.name
    | stats latest("mx.grid.endpoint.expected_engine.count") as desiredCount by endpoint.name 
        ] 
| rename endpoint.name as EndPoint desiredCount as MaxCount 
| eval {EndPoint}_processing = count 
| eval {EndPoint}_MaxCount = MaxCount 
| fields - EndPoint count MaxCount | stats values(*) as * by _time</query>
          <earliest>$global_time_tok.earliest$</earliest>
          <latest>$global_time_tok.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">area</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.overlayFields">$Token_CHART_OVERLAY$</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="charting.lineWidth">2</option>
        <option name="height">483</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>

 

Labels (1)
0 Karma

robertlynch2020
Influencer

Hi

Thanks for the trellis tip  - But is there a way to group the overlay to the correct graph?

Below, I am looking for 2 graphs, which turn into 4. I have an overlay for each data set.

robertlynch2020_0-1759941470644.png

 

0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi,

Unfortunately enabling the multi-series mode on a visualization means that *all* series are split out, this includes the series intended to be an overlay. Whilst the UI will let you select an overlay series it will not appear as such and will instead be treated as a separate series.

The only way to get around this would be to use trellis mode instead of multi-series. This would allow you to still use the overlay as per the example below:

livehybrid_0-1759939950240.png

 

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...