Splunk Search

Background chart Overlay in Area Graph

abhayneilam
Contributor

Hi,

I have a chart overlay based on one field, but it is coming as line graph (by default ) . I want this to be in "area" graph and also it has to be in the background. Kindly help me to achieve my result.

Thanks in advance !!

hagjos43
Contributor

I have something similar. Here is mine (XML directly from the dashboard). Take and modify as needed:

    <title>Page Views Trend</title>
    <searchString>index=* sourcetype=* host=* utma=* | timechart count | eventstats avg(count) as average | eval average=round(average,0)</searchString>
    <earliestTime>$earliest$</earliestTime>
    <latestTime>$latest$</latestTime>
    <option name="charting.chart">line</option>
    <option name="charting.legend.placement">bottom</option>
    <option name="charting.legend.masterLegend">null</option>
    <option name="height">250px</option>
    <option name="charting.chart.overlayFields">average</option>
    <option name="charting.fieldColors">{"count": 0x639BF1, "median":0xFF5A09}</option>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">false</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="refresh.time.visible">false</option>
  </chart>

The above line charting.chart.overlayFields is what you are looking for here. I've tested this and it does also work for displaying in Area format as well as line.

0 Karma

abhayneilam
Contributor

I am already using "charting.chart.overlayFields", but the thing is that it is coming in line , I need that to come as an "area" graph and that too in a backgroud.

0 Karma

hagjos43
Contributor

And you've changed:

line

To be

area

?

0 Karma

HattrickNZ
Motivator

@hagjos43

I found the folowing in my XML and changed linear to area is this what you mean?

<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.maximumNumber">100000</option>
<option name="charting.axisY.minimumNumber">0</option>
<option name="charting.axisY.scale">linear</option>

However, This did not work for me, one fileld is still a bar chart and the other is a line.

0 Karma

abhayneilam
Contributor

I have four fields, in which over lay has on only one field lets say NAME ,other three fields are coming as Area Graph because I have used area, but for NAME ( the overlay field ) is coming as Line Graph.

I want Name also in area graph and that too in a background.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...