Splunk Search

How to overlay a line chart on a column chart in Simple XML on Splunk 6.1?

ashishpok79
Explorer

All,

I have tried many options mentioned in the community answers but none of them seem to work. I need to overlay a column chart on line chart (vice-versa will work too) but the issue I seem to be getting into is I know the names of the series that should end up as columns but the ones that are lines are created dynamically.

  1. Started with recommendations in http://answers.splunk.com/answers/111780/chart-overlay-and-different-graph-types-using-splunk-6-in-s... and it seems like these options are ignored by Splunk 6.1 now for Simple XML. Can I still use these options in 6.1 somehow?

  2. There is a way in UI to add overlay in 6.1. That works but:

    • Overlay chart seems to be line graph only and I cannot change it to column type. If I could, my problem is resolved.
   - I cannot use a wildcard in charting.chart.overlayFields option. I was thinking of prefixing dynamic fields with some static string and using a wildcard match to overlay those fields as line. This way I can have my main chart plotted as columns and overlay as line. But overlayFields option doesn't seem to like wildcard.

Anyone know of a way to do this in Simple XML?

Appreciate your input...

Tags (3)

dvb
Path Finder

You can find the answer in the documentation:
http://docs.splunk.com/Documentation/Splunk/6.1/Viz/Chartcontrols#Chart_overlay_example_.28single_ax...

key for it to work is choosing "View as Axis" to be "Off"

0 Karma

ashishpok79
Explorer

As mentioned in my original post, series for my line charts are dynamic and that for column chart is known. With that, I either need to change the overlay graph to column or somehow dynamically set multiple series of line chart. The feature you pointed to seems to (1) need name of series for overlay to be known (2) overlay can only be line chart unless I am missing something.

0 Karma

ashishpok79
Explorer

I am guessing there is no way to do this, then? It feels like this should be supported and I am missing something simple.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...