Splunk Search
Highlighted

TimeChart Display query result in text format

Engager

Hello,

 

I have a timechart with multiple fields, I want to append existing query or add new query to display one field as a text in graph.

Example:

Screen Shot 2020-06-26 at 12.40.44 PM.png

 I am having above graph, want to display text (field) from search query at the two purple circles .

 

Thanks,

0 Karma
Highlighted

Re: TimeChart Display query result in text format

Communicator

Hi @smahuja ,

Should the text also be alligned to some time on the chart?

If I understood your request correct, you could work with Event Annotation.
https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartEventAnnotations

You have to edit the Dashboards XML as described in the Documentation.

Hope this helps.

Ralph

0 Karma
Highlighted

Re: TimeChart Display query result in text format

Engager

Hello rnowitzki

Thanks for your reply, although I was looking for a proper string like fileName/objectName. If you know anything like that, please let me know otherwise I find this also helpful.

 

Thanks,

 

Tags (1)
0 Karma
Highlighted

Re: TimeChart Display query result in text format

Communicator

Hello @smahuja ,

Not sure what you exactly mean.

If the filename/objectname is in the results of your annotation search, you can display it as the text of the Annotation.

| eval annotation_label = <field>



 Is that what you need?

View solution in original post

0 Karma