Splunk Search

Background chart Overlay in Area Graph

abhayneilam
Contributor

Hi,

I have a chart overlay based on one field, but it is coming as line graph (by default ) . I want this to be in "area" graph and also it has to be in the background. Kindly help me to achieve my result.

Thanks in advance !!

hagjos43
Contributor

I have something similar. Here is mine (XML directly from the dashboard). Take and modify as needed:

    <title>Page Views Trend</title>
    <searchString>index=* sourcetype=* host=* utma=* | timechart count | eventstats avg(count) as average | eval average=round(average,0)</searchString>
    <earliestTime>$earliest$</earliestTime>
    <latestTime>$latest$</latestTime>
    <option name="charting.chart">line</option>
    <option name="charting.legend.placement">bottom</option>
    <option name="charting.legend.masterLegend">null</option>
    <option name="height">250px</option>
    <option name="charting.chart.overlayFields">average</option>
    <option name="charting.fieldColors">{"count": 0x639BF1, "median":0xFF5A09}</option>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">false</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="refresh.time.visible">false</option>
  </chart>

The above line charting.chart.overlayFields is what you are looking for here. I've tested this and it does also work for displaying in Area format as well as line.

0 Karma

abhayneilam
Contributor

I am already using "charting.chart.overlayFields", but the thing is that it is coming in line , I need that to come as an "area" graph and that too in a backgroud.

0 Karma

hagjos43
Contributor

And you've changed:

line

To be

area

?

0 Karma

HattrickNZ
Motivator

@hagjos43

I found the folowing in my XML and changed linear to area is this what you mean?

<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.maximumNumber">100000</option>
<option name="charting.axisY.minimumNumber">0</option>
<option name="charting.axisY.scale">linear</option>

However, This did not work for me, one fileld is still a bar chart and the other is a line.

0 Karma

abhayneilam
Contributor

I have four fields, in which over lay has on only one field lets say NAME ,other three fields are coming as Area Graph because I have used area, but for NAME ( the overlay field ) is coming as Line Graph.

I want Name also in area graph and that too in a background.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

How to find the worst searches in your Splunk environment and how to fix them

Everyone knows Splunk is a powerful platform for running searches and doing data analytics. Your ...

Share Your Feedback: On Admin Config Service (ACS)!

Help Us Build a Better Admin Config Service Experience (ACS)   We Want Your Feedback on Admin Config Service ...