Hi.. The first image pretty much explains about the data and the way we want to log the values for each case_id having multiple problems and solutions. Looking for a format or structure to log pairwise combination of all the problems and its corresponding solutions w.r.t each case as one event, so that we can still unpack the table as shown in the second image. From which the dashboard metrics in the third image could be generated. And as only onetime processing occur for each case we might not get multiple events on same case. Even though, we do maintain a date value as well in the event, so that the latest event can be considered in case of multiple events on same case. ... View more

You can use the same token $test$ of the (Select Maximum 5) of multi value panel for controlling the display of other panels. When nothing is selected the token $test$ will be unset so that can help control the display. ... View more

That worked perfectly !! Thanks a lot. ... View more

Thanks for clarifying. Interesting to know the combination of lookup and xyseries ! ... View more

Thanks for the response. Also I have an additional challenge along with this which I have posted at below link. If possible please clarify: https://answers.splunk.com/answers/813163/how-to-combine-an-xyseries-output-with-other-aggre.html?minQuestionBodyLength=80 ... View more

Hi.. I was able to achieve it using Multiseries tooltip option 1 with series compare with timechart by sourcetypes. When I scroll over the timeline, it definitely shows the dots on all the graphs at the same time, but how does it show what is the value at each of those dots it puts in on that vertical time line ? Cause I only see dots, can understand the trend but how to see exact value for each of the dots on the vertical time line ? ... View more

Thank you. The requirement I have is: -> In the example above you have the graph for below query (Let me call it Chart 1 - Splunk 7 Multiple Series Compare) index="_internal" sourcetype="splunkd" log_level!="INFO" earliest="-1d@d" latest="-0d@d" | timechart span=1h count by log_level Say in the same dashboard there are two other graphs based on different queries: -> App Server - Log index="app_serv_index" sourcetype="app_serv001" earliest="-1d@d" latest="-0d@d" | timechart span=1h count by hits -> DB Server - Log index="db_serv_index" sourcetype="db_serv002" earliest="-1d@d" latest="-0d@d" | timechart span=1h requests Now if I point the mouse at a specific time in the graph of "DB Server - Log" graph; how do I show the values for below other two graphs at the same time ? - Chart 1 - Splunk 7 Multiple Series Compare List item - DB Server - Log ... View more

I am not able to attach the screenshot; but let me again explain what I am trying to ask: Say I have 3 graphs in a dashboard: 1. DB Request count over time (timechart) - This is from DB log file uploaded with a different source type and index type and graph populated with its own query. 2. IIS Request count over time (timechart) - This is from webserver log file uploaded with a different source type and index type and graph populated with its own query. 3. Application server hits (timechart) - This is from application server log file uploaded with a different source type and index type and graph populated with its own query. All 3 graphs have X axis as time and Y axis as some kind of count based on their own log, source, index. Requirement: Say on graph 3 (Application server hits) I point my mouse at a specific point in time on this graph, there should be a tooltip shown which shows values at that time from all 3 graphs. Eg. If I point my mouse on Application server hits graph at 12/29/2017 2:10 PM to see the value of Application server hits as 100021 then the tooltip there should show: _time - 12/29/2017 2:10 PM DB request count = 1 IIS request count = 40 App server hit = 100021 Similarly say on graph 1 (DB request count) I point my mouse at a specific point in time on this graph, there should be a tooltip shown which shows values at that time from all 3 graphs. Eg. If I point my mouse on DB request count graph at 12/29/2017 5:30 PM to see the value of DB request count as 7 then the tooltip there should show: _time - 12/29/2017 2:10 PM DB request count = 7 IIS request count = 35 App server hit = 54998 So moving the mouse around any of these 3 graphs populated should read the time value in that graph and be able to pull the value at that specific time from all the 3 graphs at that time and display as a tooltip. If this is not feasible then atleast a vertical line should be shown from top to bottom running across all the 3 graphs at that same time, so we can see all 3 values at that time from all graphs at the time. ... View more