Splunk Search

Chart overlay is invisbile

AKG1_old1
Builder

Hi,

I am using line chart overlay on column chart. but It's not displaying overlay line chart, even though data points are present. When I hover the mouse, I can see all data points.

When I use charting.chart.nullValueMode = gaps , It display all data points as bubble.

 <option name="charting.chart.nullValueMode">gaps</option>

And charting.chart.nullValueMode = connect, won't display overlay chart.

<option name="charting.chart.nullValueMode">connect</option> 

It there any other option to make line chart visible ?

alt text

Query:

| tstats summariesonly=true max(MXTIMING.Elapsed) AS Elapsed FROM datamodel=MXTIMING_V3 WHERE source="$MXTIMING_FULL_FILE_token$" GROUPBY MXTIMING.Context+Command MXTIMING.Time _time  | rename MXTIMING.Context+Command as Context+Command  | rename MXTIMING.Time as Time | timechart bins=1000 max(Elapsed)   by Context+Command  | appendcols [ | tstats summariesonly=true max(MXTIMING.Memory) AS Memory FROM datamodel=MXTIMING_V3 WHERE source="$MXTIMING_FULL_FILE_token$" GROUPBY MXTIMING.Context+Command MXTIMING.Time _time | timechart bins=1000 max(Memory) as Memory ]

Thanks

kmaron
Motivator

have you tried <option name="charting.chart.nullValueMode">zero</option>

0 Karma

AKG1_old1
Builder

not working. It just showing bubble if value is zero.

0 Karma

preacher_15
Explorer

@agoyal did you ever find the answer for this??? even i am facing the same issue.

0 Karma

p_gurav
Champion

Hi,

Can you try adding following parameter below nullValueMode = connect:

 <option name="charting.chart.showMarkers">true</option>
0 Karma

AKG1_old1
Builder

After adding this chart is showing only bubbles at data points , no line to connect them.

Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...