Hi,
I'm having trouble getting splitSeries to work in a Dashboard. I'd thought it was a problem with my saved search and advanced XML but having tried many approaches I'm not making headway. As a test, I created the simple version below but even with this the graph is still depicted as a single view rather than the split view I believe I'm configuring. I've come to the point where I'm not sure if I have a problem with the Syntax below or if this an a genuine issue with the splitSeries function?
thanks
Gary
<?xml version='1.0' encoding='utf-8'?>
<dashboard>
<label>Alert Graph</label>
<row>
<chart>
<searchString>index=geneos source="/var/log/geneos.log" | head 10000 | rex "(?i)^(?:[^ ]* ){4}(?P<Status>[^:]+)" | timechart count(Status) by Status</searchString>
<title>Alerts over past hour</title>
<earliestTime>-1h</earliestTime>
<latestTime>now</latestTime>
<option name="charting.chart">area</option>
<option name="charting.legend.placement">Right</option>
<option name="charting.layout.splitSeries">True</option>
<option name="charting.primaryAxisTitle.text">Time</option>
<option name="charting.secondaryAxisTitle.text">Count</option>
</chart>
</row>
</dashboard>
This was something I was trying to do a few months ago. In the end I had to take a different approach but would have really loved to get this working. I'm with you, I think its a bug, but unfortunately none have the Splunk Enginners have picked this one up yet. Hopefully they'll take a look at some point.
I have this same problem. Perhaps it's a bug? I'm running 4.2.4 (110225).