Splunk Search

How to overlay a line chart on a column chart in Simple XML on Splunk 6.1?

ashishpok79
Explorer

All,

I have tried many options mentioned in the community answers but none of them seem to work. I need to overlay a column chart on line chart (vice-versa will work too) but the issue I seem to be getting into is I know the names of the series that should end up as columns but the ones that are lines are created dynamically.

  1. Started with recommendations in http://answers.splunk.com/answers/111780/chart-overlay-and-different-graph-types-using-splunk-6-in-s... and it seems like these options are ignored by Splunk 6.1 now for Simple XML. Can I still use these options in 6.1 somehow?

  2. There is a way in UI to add overlay in 6.1. That works but:

    • Overlay chart seems to be line graph only and I cannot change it to column type. If I could, my problem is resolved.
   - I cannot use a wildcard in charting.chart.overlayFields option. I was thinking of prefixing dynamic fields with some static string and using a wildcard match to overlay those fields as line. This way I can have my main chart plotted as columns and overlay as line. But overlayFields option doesn't seem to like wildcard.

Anyone know of a way to do this in Simple XML?

Appreciate your input...

Tags (3)

dvb
Path Finder

You can find the answer in the documentation:
http://docs.splunk.com/Documentation/Splunk/6.1/Viz/Chartcontrols#Chart_overlay_example_.28single_ax...

key for it to work is choosing "View as Axis" to be "Off"

0 Karma

ashishpok79
Explorer

As mentioned in my original post, series for my line charts are dynamic and that for column chart is known. With that, I either need to change the overlay graph to column or somehow dynamically set multiple series of line chart. The feature you pointed to seems to (1) need name of series for overlay to be known (2) overlay can only be line chart unless I am missing something.

0 Karma

ashishpok79
Explorer

I am guessing there is no way to do this, then? It feels like this should be supported and I am missing something simple.

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...