Splunk Search

How to make a chart overlay

New Member

I'm trying to make a graph using a chart overlay, scenario is I want to put all the transactions with minutes to the left and right for all transactions that are in count. Please see my search below and the graph.

index="appdynamics" source="metrics.log" sourcetype="metrics" name=RDYWPD01-TomcatA:ServiceProxy:PortalProd:VerySlowCalls OR name=RDYWPD01-TomcatA:ServiceProxy:PortalProd:CallsPerMin OR name=RDYWPD01-TomcatA:ServiceProxy:PortalProd:ErrorsPerMin OR name=RDYWPD01-TomcatA:ServiceProxy:PortalProd:StallCount OR name=RDYWPD01:TomcatA:PortalProd:AveResponseTime
| timechart span=1d avg(value) by name
| rename RDYWPD01-TomcatA:ServiceProxy:PortalProd:VerySlowCalls as "Very Slow Calls", RDYWPD01-TomcatA:ServiceProxy:PortalProd:CallsPerMin as "Calls per minute", RDYWPD01-TomcatA:ServiceProxy:PortalProd:ErrorsPerMin as "Error per minute", RDYWPD01-TomcatA:ServiceProxy:PortalProd:StallCount as "Stall Counts", RDYWPD01:TomcatA:PortalProd:AveResponseTime as "Average Response Time (ms)"][1]

0 Karma


@vino06... While you want to overlay Time fields over Count fields, your time fields are both in minute and millisecons. Based on the output, you might have to change the unit.

    <option name="charting.axisTitleY.text">Count</option>
    <option name="charting.axisTitleY2.text">Time</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart.overlayFields">"Calls per minute", "Error per minute","Average Response Time (ms)"</option>
    <option name="charting.chart.nullValueMode">zero</option>

PS: Based on the screenshot, you also might want to set the Null Value Mode to zero or connected which is currently gap. All these settings are directly accessible fromEdit > Format visualization in UI (if you want to avoid changing via Simple XML)

| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Super Champion

this question was asked earlier. https://answers.splunk.com/answers/542628/chart-overlay-1.html for reference.

0 Karma


HI @vino06,
First, create overlay field in the search.

//for example if overlay=100

YOUR SEARCH | eval overlay=100  

Second, add charting.chart.overlayFields option in chart xml.

<option name="charting.chart.overlayFields">overlay</option>

I hope it's helpful to you.


Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...