Hello, Has anyone had any luck in getting this to work with special characters?  I have tried a few iterations of this but am not seeing any color changes: <option name="charting.fieldColors">{<![CDATA[">"]]> + "= 10": 0x57831}</option> <option name="charting.fieldColors">{<![CDATA[>]]> + "= 10": 0x57831}</option> <option name="charting.fieldColors">{<![CDATA[">= 10"]]>: 0x57831}</option> Thanks in advance! ... View more

I faced a similar issue and resolved it by creating an "inverse" timestamp and using that to bucket events on instead of _time. For example: ... | eval repoch=relative_time(now(),"+0d@d-1d") Pick a latest time (I was interested in values upto and including yesterday) | eval retime=repoch-_time Calculate time prior to your new epoch | bin retime span=7d Set bin based on new time (this gets 7 days prior going backwards) | stats dc(_time) as days, sum(count) as count by Column, retime I was interest in counts over 7 days.  | where days = 7 | ... I then only took complete weeks going forward Obviously the date can be recovered by subtracting from repoch again if you need it. ... View more

Hi, I don't see the min/max labels on your chart...also, I'm on Splunk 6.5 so we don't have Trellis available 😞 ... View more

Thank you so much @niketnilay ^_^ I went with your second suggestion and the dashboard working perfectly now!! Here's the first section of XML (for token setting/switching text in search query): <input type="radio" token="field4" searchWhenChanged="true"> <label>By Hour/Weekday/Month</label> <choice value="&quot;%H&quot;">Hour</choice> <choice value="&quot;%A&quot;">Weekday</choice> <choice value="&quot;%B&quot;">Month</choice> <change> <condition value="&quot;%H&quot;"> <set token="date_label">Hour</set> <set token="sort_query"></set> </condition> <condition value="&quot;%A&quot;"> <set token="date_label">Weekday</set> <set token="sort_query">| eval sort_field = case(date=="Monday",1, date=="Tuesday",2, date=="Wednesday",3, date=="Thursday",4, date=="Friday",5, date=="Saturday",6, date=="Sunday",7)</set> </condition> <condition value="&quot;%B&quot;"> <set token="date_label">Month</set> <set token="sort_query">| eval sort_field = case(date=="January",1, date=="February",2, date=="March",3, date=="April",4, date=="May",5, date=="June",6, date=="July",7, date=="August",8, date=="September",9, date=="October",10, date=="November",11, date=="December",12)</set> </condition> </change> <default>"%A"</default> <initialValue>"%A"</initialValue> </input> Second section of XML (for graphs): <row> <panel> <chart> <title>By $date_label$</title> <search> <query>index=os (sourcetype=cpu cpu=all) OR (sourcetype=vmstat) | lookup sa_managed_servers_new.csv host | search server_group=SA machine_type=$field2$ sadb_service=$field3$ | eval Percent_CPU_Load = 100 - pctIdle | eval date=strftime(_time,$field4$) | stats avg(Percent_CPU_Load) avg(memUsedPct) avg(swapUsedPct) by date | rename avg(Percent_CPU_Load) AS "Avg CPU" avg(memUsedPct) as "Avg Memory" avg(swapUsedPct) AS "Avg Swap Memory" $sort_query$ | sort sort_field | fields - sort_field</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisTitleY.text">%</option> <option name="charting.axisY.maximumNumber">100</option> <option name="charting.axisY.minimumNumber">0</option> <option name="charting.chart">line</option> <option name="charting.chart.showDataLabels">minmax</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> </chart> </panel> ... View more

Hi @niketnilay, I'd like to have the same time filter and search query, but only the time spans are different. The time selected for both searches will change depending on the filter selected. Also, I used values() because I'm looking at CPU data, and oftentimes CPU jumps from low to high within a time span, so I wanted to capture it all. That's why one of the chart is using the average and the other is using all its values. I wanted to overlay them so we can easily see all the CPU activity of a server, but also use the average line chart to see any overall trends. Hi @gpradeepkumarreddy I believe chart overlay doesn't work if the charts are using different time spans (at least I have not gotten it to work with different spans). Thanks! ... View more

Thanks! So the reason why the first image returns 5 results is because there are actually 5 other rows of data (for 5 different hosts/servers) which I didn't capture in the screenshot. It doesn't reflect the data that goes into creating the sparkline, it is only the result of all the hosts/servers from my query: stats sparkline(avg(Percent_CPU_Load)) as Activity avg(Percent_CPU_Load) as Average, max(Percent_CPU_Load) as Peak, min(Percent_CPU_Load) as Low, avg(pctIowait) as WaitTime by host That is why I believe the problem is in this part of the query: | search CPUbucket="Greater than 95%" CPU=all However, I need that part of the query because I want to search for ALL hosts/servers that have CPU Greater than 95%, so I need that search option in there. However, I also need the sparkline to show the individual trend of a specific host/server and somehow it's not portraying it accurately. ... View more

@josephinemho, please try out and confirm! ... View more

Hi Josephinemho, Unfortunately the downsampled Line Chart ( or any Machine Learning Toolkit built-in Visualization) doesn't support custom options (color, size, etc.) at the moment. ... View more