I have many different but simultaneous metrics that I am graphing over time. The y axis for each have different ranges. (0 to a million or 30% to 70% or whatever) but the time (x axis) is concurrent for all.
I want to put these charts in a dashboard, vertically stacked, and have the timescales for each match up exactly.
Some things I have tried that don't quite work:
field - away the ones I don't care about about for each panel. This is tedious and I have not gotten consistent results. Also, the search for the report becomes complex as I have multiple indexes, sources and sourcetypes for each time series. Ideally each search could run independent but share a single timescale for the entire dashboard.I have seen tools like Grafana do this easily. I don't need the shared crosshair like Grafana does, but I do need a shared timescale.
Surely there is a way to do this with Splunk and I am just ignorant.
Please help!
Thanks
You can set the static y axis values by going to Format and selecting the static ranges
It is the x axis (time) that I need to be manually set actually.
y axis should conform to whatever the range of the data is.
Are you referring to splitting time into finer granularities? If so, you use span parameter on your timechart command
that is part of it, but not entirely the thing. I need the left and right bounds of the time scale to be identical for multiple charts. In doing that I also expect that the bucket size (which you could set with span) to be identical, but don't want to set span explicitly because the timescale will vary widely from dashboard to dashboard.
After doing some reading it seems I need to set <earliest> and <latest> in the xml for each chart. I am trying to do that now based off a report but can't figure out how to set those tokens yet.
@peterson_wwt found answer to this?
Facing exactly the same problem.