Splunk Search

Background chart Overlay in Area Graph

abhayneilam
Contributor

Hi,

I have a chart overlay based on one field, but it is coming as line graph (by default ) . I want this to be in "area" graph and also it has to be in the background. Kindly help me to achieve my result.

Thanks in advance !!

hagjos43
Contributor

I have something similar. Here is mine (XML directly from the dashboard). Take and modify as needed:

    <title>Page Views Trend</title>
    <searchString>index=* sourcetype=* host=* utma=* | timechart count | eventstats avg(count) as average | eval average=round(average,0)</searchString>
    <earliestTime>$earliest$</earliestTime>
    <latestTime>$latest$</latestTime>
    <option name="charting.chart">line</option>
    <option name="charting.legend.placement">bottom</option>
    <option name="charting.legend.masterLegend">null</option>
    <option name="height">250px</option>
    <option name="charting.chart.overlayFields">average</option>
    <option name="charting.fieldColors">{"count": 0x639BF1, "median":0xFF5A09}</option>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">false</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="refresh.time.visible">false</option>
  </chart>

The above line charting.chart.overlayFields is what you are looking for here. I've tested this and it does also work for displaying in Area format as well as line.

0 Karma

abhayneilam
Contributor

I am already using "charting.chart.overlayFields", but the thing is that it is coming in line , I need that to come as an "area" graph and that too in a backgroud.

0 Karma

hagjos43
Contributor

And you've changed:

line

To be

area

?

0 Karma

HattrickNZ
Motivator

@hagjos43

I found the folowing in my XML and changed linear to area is this what you mean?

<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.maximumNumber">100000</option>
<option name="charting.axisY.minimumNumber">0</option>
<option name="charting.axisY.scale">linear</option>

However, This did not work for me, one fileld is still a bar chart and the other is a line.

0 Karma

abhayneilam
Contributor

I have four fields, in which over lay has on only one field lets say NAME ,other three fields are coming as Area Graph because I have used area, but for NAME ( the overlay field ) is coming as Line Graph.

I want Name also in area graph and that too in a background.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...