All Apps and Add-ons

Displaying two visualizations in one dashboard panel

bruceclarke
Contributor

All,

I have a dashboard panel that I want to display two visualizations on. The first is a stacked area graph that displays the amount of time spent processing in browser vs network vs server. The second is a line chart that just has the count of events over that same timespan. I posted an image below for your convenience.

alt text

Hopefully that didn't get cut off, but in case it did, the purple area is actually the count of events over that time range. I want the blue, yellow, and red areas to display as-is, but the purple area should be a separate line graph.

It would be ideal if the count had it's own separate axes on the right, but in this case the scales are about the same for each visualization, so that's not required. I've read up enough to know this is possible, but I can't find the details to get it to work. Any help wold be greatly appreciated.

Thanks!

1 Solution

nfilippi_splunk
Splunk Employee
Splunk Employee

Splunk 6 no longer supports the FlashCharts library in Simple XML, which is what was used to generate these chart overlays. This is also the reason why some of your "charting.*" options do not work, as they are specific to FlashCharts, and including them in your XML would previously trigger Splunk to invoke FlashCharts as the rendering engine for that chart.

As a temporary workaround, Advanced XML still supports FlashCharts, and can be used for this use case.

View solution in original post

nfilippi_splunk
Splunk Employee
Splunk Employee

Splunk 6 no longer supports the FlashCharts library in Simple XML, which is what was used to generate these chart overlays. This is also the reason why some of your "charting.*" options do not work, as they are specific to FlashCharts, and including them in your XML would previously trigger Splunk to invoke FlashCharts as the rendering engine for that chart.

As a temporary workaround, Advanced XML still supports FlashCharts, and can be used for this use case.

nfilippi_splunk
Splunk Employee
Splunk Employee

Correct, Splunk 6.1 now supports Chart Overlay in both Simple XML and the UI Viz Editor. In short, you can take a column/area/line chart, and add an overlay by setting:
- field(s) that you want to use in the overlay
- Single or dual y-axis
- If dual y-axis, then you have several axis label/scale.min/max settings

0 Karma

bruceclarke
Contributor

Sounds like this might be included in the 6.1 release. Can you confirm?

0 Karma

bruceclarke
Contributor

Can you link me to documentation on Advanced XML vs Simple XML? Thanks for the answer!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Basically you want to show two charts in one visualization. There are many such problem discussed before in this forum. Here are some of them which might be helpful.

Example 1

Example 2

Example 3

bruceclarke
Contributor

I've actually been to all of these pages. In fact, Example 3 is exactly the template I have been using. The search I am doing looks exactly like the search from that example. However, when I alter the simple XML, Splunk only respects the first chart's display type and doesn't respect any of the "charting.*.columns" properties. In other words, it just tries to apply the first charts display to all returned columns.

Does timespan mess up chart overlays? Is chart overlay not respected in Splunk 6? Any insight would be appreciated.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...