Splunk Search

How to make a chart overlay

New Member

I'm trying to make a graph using a chart overlay, scenario is I want to put all the transactions with minutes to the left and right for all transactions that are in count. Please see my search below and the graph.

index="appdynamics" source="metrics.log" sourcetype="metrics" name=RDYWPD01-TomcatA:ServiceProxy:PortalProd:VerySlowCalls OR name=RDYWPD01-TomcatA:ServiceProxy:PortalProd:CallsPerMin OR name=RDYWPD01-TomcatA:ServiceProxy:PortalProd:ErrorsPerMin OR name=RDYWPD01-TomcatA:ServiceProxy:PortalProd:StallCount OR name=RDYWPD01:TomcatA:PortalProd:AveResponseTime
| timechart span=1d avg(value) by name
| rename RDYWPD01-TomcatA:ServiceProxy:PortalProd:VerySlowCalls as "Very Slow Calls", RDYWPD01-TomcatA:ServiceProxy:PortalProd:CallsPerMin as "Calls per minute", RDYWPD01-TomcatA:ServiceProxy:PortalProd:ErrorsPerMin as "Error per minute", RDYWPD01-TomcatA:ServiceProxy:PortalProd:StallCount as "Stall Counts", RDYWPD01:TomcatA:PortalProd:AveResponseTime as "Average Response Time (ms)"][1]

0 Karma


@vino06... While you want to overlay Time fields over Count fields, your time fields are both in minute and millisecons. Based on the output, you might have to change the unit.

    <option name="charting.axisTitleY.text">Count</option>
    <option name="charting.axisTitleY2.text">Time</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart.overlayFields">"Calls per minute", "Error per minute","Average Response Time (ms)"</option>
    <option name="charting.chart.nullValueMode">zero</option>

PS: Based on the screenshot, you also might want to set the Null Value Mode to zero or connected which is currently gap. All these settings are directly accessible fromEdit > Format visualization in UI (if you want to avoid changing via Simple XML)

| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Super Champion

this question was asked earlier. https://answers.splunk.com/answers/542628/chart-overlay-1.html for reference.

0 Karma


HI @vino06,
First, create overlay field in the search.

//for example if overlay=100

YOUR SEARCH | eval overlay=100  

Second, add charting.chart.overlayFields option in chart xml.

<option name="charting.chart.overlayFields">overlay</option>

I hope it's helpful to you.


State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!