Splunk Search

Is it possible to set "connect mode" for null values in a chart overlay?

vaibhavagg2006
Communicator

I have a column chart with chart overlay. Can we set "connect mode" for null values in chart overlay lines?

Tags (3)
0 Karma

niketn
Legend

alt textIf you want to do it by the UI, first choose the Visualization as Line Chart and then select Null Values as Connect. Then change to any other chart that you want to use and use Chart Overlay.

Alternatively you can add the following to Dashboard in Simple XML:

<option name="charting.chart.nullValueMode">connect</option>

Updated answers I have attached screenshot of a Chart with Overlaid fields AvgOverall...

<option name="charting.chart.overlayFields">AvgOverall</option>

As you can see Based on Null Value Mode - Gaps, Connect and Zero, I can get different interpretation of series where ever data is not present or null.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

vaibhavagg2006
Communicator

This does not work for overlay chart. It only works for regular line chart.

0 Karma

niketn
Legend

@vaibhavagg2006 I have updated my answers and added a screenshot to show that nullValueMode is applicable to Overlaid fields also.

Please let me know if I have misunderstood your question in anyway. In case I have please add current Screenshot and if possible the expected behavior.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

chanst2
Path Finder

Just add this to that chart section in the XML source will do:
connect

0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...