Splunk Search

How to overlay a line chart on a column chart in Simple XML on Splunk 6.1?

ashishpok79
Explorer

All,

I have tried many options mentioned in the community answers but none of them seem to work. I need to overlay a column chart on line chart (vice-versa will work too) but the issue I seem to be getting into is I know the names of the series that should end up as columns but the ones that are lines are created dynamically.

  1. Started with recommendations in http://answers.splunk.com/answers/111780/chart-overlay-and-different-graph-types-using-splunk-6-in-s... and it seems like these options are ignored by Splunk 6.1 now for Simple XML. Can I still use these options in 6.1 somehow?

  2. There is a way in UI to add overlay in 6.1. That works but:

    • Overlay chart seems to be line graph only and I cannot change it to column type. If I could, my problem is resolved.
   - I cannot use a wildcard in charting.chart.overlayFields option. I was thinking of prefixing dynamic fields with some static string and using a wildcard match to overlay those fields as line. This way I can have my main chart plotted as columns and overlay as line. But overlayFields option doesn't seem to like wildcard.

Anyone know of a way to do this in Simple XML?

Appreciate your input...

Tags (3)

dvb
Path Finder

You can find the answer in the documentation:
http://docs.splunk.com/Documentation/Splunk/6.1/Viz/Chartcontrols#Chart_overlay_example_.28single_ax...

key for it to work is choosing "View as Axis" to be "Off"

0 Karma

ashishpok79
Explorer

As mentioned in my original post, series for my line charts are dynamic and that for column chart is known. With that, I either need to change the overlay graph to column or somehow dynamically set multiple series of line chart. The feature you pointed to seems to (1) need name of series for overlay to be known (2) overlay can only be line chart unless I am missing something.

0 Karma

ashishpok79
Explorer

I am guessing there is no way to do this, then? It feels like this should be supported and I am missing something simple.

Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...