Splunk Search

Background chart Overlay in Area Graph

abhayneilam
Contributor

Hi,

I have a chart overlay based on one field, but it is coming as line graph (by default ) . I want this to be in "area" graph and also it has to be in the background. Kindly help me to achieve my result.

Thanks in advance !!

hagjos43
Contributor

I have something similar. Here is mine (XML directly from the dashboard). Take and modify as needed:

    <title>Page Views Trend</title>
    <searchString>index=* sourcetype=* host=* utma=* | timechart count | eventstats avg(count) as average | eval average=round(average,0)</searchString>
    <earliestTime>$earliest$</earliestTime>
    <latestTime>$latest$</latestTime>
    <option name="charting.chart">line</option>
    <option name="charting.legend.placement">bottom</option>
    <option name="charting.legend.masterLegend">null</option>
    <option name="height">250px</option>
    <option name="charting.chart.overlayFields">average</option>
    <option name="charting.fieldColors">{"count": 0x639BF1, "median":0xFF5A09}</option>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">false</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="refresh.time.visible">false</option>
  </chart>

The above line charting.chart.overlayFields is what you are looking for here. I've tested this and it does also work for displaying in Area format as well as line.

0 Karma

abhayneilam
Contributor

I am already using "charting.chart.overlayFields", but the thing is that it is coming in line , I need that to come as an "area" graph and that too in a backgroud.

0 Karma

hagjos43
Contributor

And you've changed:

line

To be

area

?

0 Karma

HattrickNZ
Motivator

@hagjos43

I found the folowing in my XML and changed linear to area is this what you mean?

<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.maximumNumber">100000</option>
<option name="charting.axisY.minimumNumber">0</option>
<option name="charting.axisY.scale">linear</option>

However, This did not work for me, one fileld is still a bar chart and the other is a line.

0 Karma

abhayneilam
Contributor

I have four fields, in which over lay has on only one field lets say NAME ,other three fields are coming as Area Graph because I have used area, but for NAME ( the overlay field ) is coming as Line Graph.

I want Name also in area graph and that too in a background.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...