Splunk Search

Chart overlay is invisbile

AKG1_old1
Builder

Hi,

I am using line chart overlay on column chart. but It's not displaying overlay line chart, even though data points are present. When I hover the mouse, I can see all data points.

When I use charting.chart.nullValueMode = gaps , It display all data points as bubble.

 <option name="charting.chart.nullValueMode">gaps</option>

And charting.chart.nullValueMode = connect, won't display overlay chart.

<option name="charting.chart.nullValueMode">connect</option> 

It there any other option to make line chart visible ?

alt text

Query:

| tstats summariesonly=true max(MXTIMING.Elapsed) AS Elapsed FROM datamodel=MXTIMING_V3 WHERE source="$MXTIMING_FULL_FILE_token$" GROUPBY MXTIMING.Context+Command MXTIMING.Time _time  | rename MXTIMING.Context+Command as Context+Command  | rename MXTIMING.Time as Time | timechart bins=1000 max(Elapsed)   by Context+Command  | appendcols [ | tstats summariesonly=true max(MXTIMING.Memory) AS Memory FROM datamodel=MXTIMING_V3 WHERE source="$MXTIMING_FULL_FILE_token$" GROUPBY MXTIMING.Context+Command MXTIMING.Time _time | timechart bins=1000 max(Memory) as Memory ]

Thanks

kmaron
Motivator

have you tried <option name="charting.chart.nullValueMode">zero</option>

0 Karma

AKG1_old1
Builder

not working. It just showing bubble if value is zero.

0 Karma

preacher_15
Explorer

@agoyal did you ever find the answer for this??? even i am facing the same issue.

0 Karma

p_gurav
Champion

Hi,

Can you try adding following parameter below nullValueMode = connect:

 <option name="charting.chart.showMarkers">true</option>
0 Karma

AKG1_old1
Builder

After adding this chart is showing only bubbles at data points , no line to connect them.

Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...