Splunk Search

Chart overlay is invisbile

AKG1_old1
Builder

Hi,

I am using line chart overlay on column chart. but It's not displaying overlay line chart, even though data points are present. When I hover the mouse, I can see all data points.

When I use charting.chart.nullValueMode = gaps , It display all data points as bubble.

 <option name="charting.chart.nullValueMode">gaps</option>

And charting.chart.nullValueMode = connect, won't display overlay chart.

<option name="charting.chart.nullValueMode">connect</option> 

It there any other option to make line chart visible ?

alt text

Query:

| tstats summariesonly=true max(MXTIMING.Elapsed) AS Elapsed FROM datamodel=MXTIMING_V3 WHERE source="$MXTIMING_FULL_FILE_token$" GROUPBY MXTIMING.Context+Command MXTIMING.Time _time  | rename MXTIMING.Context+Command as Context+Command  | rename MXTIMING.Time as Time | timechart bins=1000 max(Elapsed)   by Context+Command  | appendcols [ | tstats summariesonly=true max(MXTIMING.Memory) AS Memory FROM datamodel=MXTIMING_V3 WHERE source="$MXTIMING_FULL_FILE_token$" GROUPBY MXTIMING.Context+Command MXTIMING.Time _time | timechart bins=1000 max(Memory) as Memory ]

Thanks

kmaron
Motivator

have you tried <option name="charting.chart.nullValueMode">zero</option>

0 Karma

AKG1_old1
Builder

not working. It just showing bubble if value is zero.

0 Karma

preacher_15
Explorer

@agoyal did you ever find the answer for this??? even i am facing the same issue.

0 Karma

p_gurav
Champion

Hi,

Can you try adding following parameter below nullValueMode = connect:

 <option name="charting.chart.showMarkers">true</option>
0 Karma

AKG1_old1
Builder

After adding this chart is showing only bubbles at data points , no line to connect them.

Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...