Splunk Search

TimeChart Display query result in text format

smahuja
Explorer

Hello,

 

I have a timechart with multiple fields, I want to append existing query or add new query to display one field as a text in graph.

Example:

Screen Shot 2020-06-26 at 12.40.44 PM.png

 I am having above graph, want to display text (field) from search query at the two purple circles .

 

Thanks,

0 Karma
1 Solution

rnowitzki
Builder

Hello @smahuja ,

Not sure what you exactly mean.

If the filename/objectname is in the results of your annotation search, you can display it as the text of the Annotation.

| eval annotation_label = <field>



 Is that what you need?

--
Karma and/or Solution tagging appreciated.

View solution in original post

0 Karma

rnowitzki
Builder

Hi @smahuja ,

Should the text also be alligned to some time on the chart?

If I understood your request correct, you could work with Event Annotation.
https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartEventAnnotations

You have to edit the Dashboards XML as described in the Documentation.

Hope this helps.

Ralph

--
Karma and/or Solution tagging appreciated.
0 Karma

smahuja
Explorer

Hello rnowitzki

Thanks for your reply, although I was looking for a proper string like fileName/objectName. If you know anything like that, please let me know otherwise I find this also helpful.

 

Thanks,

 

Tags (1)
0 Karma

rnowitzki
Builder

Hello @smahuja ,

Not sure what you exactly mean.

If the filename/objectname is in the results of your annotation search, you can display it as the text of the Annotation.

| eval annotation_label = <field>



 Is that what you need?

--
Karma and/or Solution tagging appreciated.
0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...