Splunk Search

Chart overlay is invisbile

AKG1_old1
Builder

Hi,

I am using line chart overlay on column chart. but It's not displaying overlay line chart, even though data points are present. When I hover the mouse, I can see all data points.

When I use charting.chart.nullValueMode = gaps , It display all data points as bubble.

 <option name="charting.chart.nullValueMode">gaps</option>

And charting.chart.nullValueMode = connect, won't display overlay chart.

<option name="charting.chart.nullValueMode">connect</option> 

It there any other option to make line chart visible ?

alt text

Query:

| tstats summariesonly=true max(MXTIMING.Elapsed) AS Elapsed FROM datamodel=MXTIMING_V3 WHERE source="$MXTIMING_FULL_FILE_token$" GROUPBY MXTIMING.Context+Command MXTIMING.Time _time  | rename MXTIMING.Context+Command as Context+Command  | rename MXTIMING.Time as Time | timechart bins=1000 max(Elapsed)   by Context+Command  | appendcols [ | tstats summariesonly=true max(MXTIMING.Memory) AS Memory FROM datamodel=MXTIMING_V3 WHERE source="$MXTIMING_FULL_FILE_token$" GROUPBY MXTIMING.Context+Command MXTIMING.Time _time | timechart bins=1000 max(Memory) as Memory ]

Thanks

kmaron
Motivator

have you tried <option name="charting.chart.nullValueMode">zero</option>

0 Karma

AKG1_old1
Builder

not working. It just showing bubble if value is zero.

0 Karma

preacher_15
Explorer

@agoyal did you ever find the answer for this??? even i am facing the same issue.

0 Karma

p_gurav
Champion

Hi,

Can you try adding following parameter below nullValueMode = connect:

 <option name="charting.chart.showMarkers">true</option>
0 Karma

AKG1_old1
Builder

After adding this chart is showing only bubbles at data points , no line to connect them.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...