Splunk Search

TimeChart Display query result in text format

smahuja
Explorer

Hello,

 

I have a timechart with multiple fields, I want to append existing query or add new query to display one field as a text in graph.

Example:

Screen Shot 2020-06-26 at 12.40.44 PM.png

 I am having above graph, want to display text (field) from search query at the two purple circles .

 

Thanks,

0 Karma
1 Solution

rnowitzki
Builder

Hello @smahuja ,

Not sure what you exactly mean.

If the filename/objectname is in the results of your annotation search, you can display it as the text of the Annotation.

| eval annotation_label = <field>



 Is that what you need?

--
Karma and/or Solution tagging appreciated.

View solution in original post

0 Karma

rnowitzki
Builder

Hi @smahuja ,

Should the text also be alligned to some time on the chart?

If I understood your request correct, you could work with Event Annotation.
https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartEventAnnotations

You have to edit the Dashboards XML as described in the Documentation.

Hope this helps.

Ralph

--
Karma and/or Solution tagging appreciated.
0 Karma

smahuja
Explorer

Hello rnowitzki

Thanks for your reply, although I was looking for a proper string like fileName/objectName. If you know anything like that, please let me know otherwise I find this also helpful.

 

Thanks,

 

Tags (1)
0 Karma

rnowitzki
Builder

Hello @smahuja ,

Not sure what you exactly mean.

If the filename/objectname is in the results of your annotation search, you can display it as the text of the Annotation.

| eval annotation_label = <field>



 Is that what you need?

--
Karma and/or Solution tagging appreciated.
0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? &#x1f680; We invite you to join our elite squad ...