Splunk Search

Background chart Overlay in Area Graph

abhayneilam
Contributor

Hi,

I have a chart overlay based on one field, but it is coming as line graph (by default ) . I want this to be in "area" graph and also it has to be in the background. Kindly help me to achieve my result.

Thanks in advance !!

hagjos43
Contributor

I have something similar. Here is mine (XML directly from the dashboard). Take and modify as needed:

    <title>Page Views Trend</title>
    <searchString>index=* sourcetype=* host=* utma=* | timechart count | eventstats avg(count) as average | eval average=round(average,0)</searchString>
    <earliestTime>$earliest$</earliestTime>
    <latestTime>$latest$</latestTime>
    <option name="charting.chart">line</option>
    <option name="charting.legend.placement">bottom</option>
    <option name="charting.legend.masterLegend">null</option>
    <option name="height">250px</option>
    <option name="charting.chart.overlayFields">average</option>
    <option name="charting.fieldColors">{"count": 0x639BF1, "median":0xFF5A09}</option>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">false</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="refresh.time.visible">false</option>
  </chart>

The above line charting.chart.overlayFields is what you are looking for here. I've tested this and it does also work for displaying in Area format as well as line.

0 Karma

abhayneilam
Contributor

I am already using "charting.chart.overlayFields", but the thing is that it is coming in line , I need that to come as an "area" graph and that too in a backgroud.

0 Karma

hagjos43
Contributor

And you've changed:

line

To be

area

?

0 Karma

HattrickNZ
Motivator

@hagjos43

I found the folowing in my XML and changed linear to area is this what you mean?

<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.maximumNumber">100000</option>
<option name="charting.axisY.minimumNumber">0</option>
<option name="charting.axisY.scale">linear</option>

However, This did not work for me, one fileld is still a bar chart and the other is a line.

0 Karma

abhayneilam
Contributor

I have four fields, in which over lay has on only one field lets say NAME ,other three fields are coming as Area Graph because I have used area, but for NAME ( the overlay field ) is coming as Line Graph.

I want Name also in area graph and that too in a background.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...