How to overlay a line chart on a column chart in Simple XML on Splunk 6.1?

[ashishpok79]

All,

I have tried many options mentioned in the community answers but none of them seem to work. I need to overlay a column chart on line chart (vice-versa will work too) but the issue I seem to be getting into is I know the names of the series that should end up as columns but the ones that are lines are created dynamically.

1. Started with recommendations in http://answers.splunk.com/answers/111780/chart-overlay-and-different-graph-types-using-splunk-6-in-s... and it seems like these options are ignored by Splunk 6.1 now for Simple XML. Can I still use these options in 6.1 somehow?

2. There is a way in UI to add overlay in 6.1. That works but:

   • Overlay chart seems to be line graph only and I cannot change it to column type. If I could, my problem is resolved.

   - I cannot use a wildcard in charting.chart.overlayFields option. I was thinking of prefixing dynamic fields with some static string and using a wildcard match to overlay those fields as line. This way I can have my main chart plotted as columns and overlay as line. But overlayFields option doesn't seem to like wildcard.

Anyone know of a way to do this in Simple XML?

Appreciate your input...

[dvb]

You can find the answer in the documentation:
http://docs.splunk.com/Documentation/Splunk/6.1/Viz/Chartcontrols#Chart_overlay_example_.28single_ax...

key for it to work is choosing "View as Axis" to be "Off"

[ashishpok79]

As mentioned in my original post, series for my line charts are dynamic and that for column chart is known. With that, I either need to change the overlay graph to column or somehow dynamically set multiple series of line chart. The feature you pointed to seems to (1) need name of series for overlay to be known (2) overlay can only be line chart unless I am missing something.

[ashishpok79]

I am guessing there is no way to do this, then? It feels like this should be supported and I am missing something simple.