Dashboards & Visualizations

Can I click (or hover) in a timechart to highlight that point in time in every timechart in the dashboard?

Graham_Hanningt
Builder

(Grafana does this.)

...or do I need to write my own JavaScript to do this?

Use case: I have a dashboard that contains several timecharts covering the same (time picker-based) period. When I see an anomaly in one timechart, I want to highlight (perhaps with a vertical line) that point in time in the current timechart and in every other timechart in the dashboard, to see what other timecharts might tell me about that point in time. Note: I do not want to "overload" a single timechart with all of the series that I want to chart.

Coding tips gratefully accepted: I can write JavaScript, but I have yet to write JavaScript to customize Splunk dashboards.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You mentioned "shared crosshair" - do take a look at this: https://splunkbase.splunk.com/app/3117/

0 Karma

Graham_Hanningt
Builder

Thanks very much for the link, Martin. Yes, that looks very useful: I'll try it out on Monday (I'm writing this on Friday night). Apologies for this belated acknowledgement. I don't know why I missed your comment; I just stumbled on it now as I was reviewing some of my old questions. I guess I must have overlooked the email notification, or deleted it by mistake.

0 Karma

PPape
Contributor

Yes you can do this. And you dont need to edit JavaScript.
With the Pan and Zoom function.

0 Karma

Graham_Hanningt
Builder

Thanks very much for the quick reply. With apologies (I realize I'm very likely missing something that's staring me in the face): I read that page on the Pan and Zoom function before asking this question, and could not see how that function applied to my requirement.

I'm after something similar to the "shared crosshair" in Grafana: as you mouse over one timechart in a dashboard, a red line appears in each of the other timecharts in the dashboard indicating that same point in time.

Sorry to be a pain: could you please tell me how I can achieve that, or something similar, with the Pan and Zoom function, without editing JavaScript?

0 Karma

PPape
Contributor

Well the red line seems not to be possible with the pan and zoom function. You can adjust all charts to the selected timeframe with the pan and zoom function. So they will show you exactly what happened in this timeframe but not more. You also can reset the zoom and go back to your old time selection.

0 Karma

Graham_Hanningt
Builder

Thanks for the clarification.

You can adjust all charts to the selected timeframe with the pan and zoom function.

Are you referring to using <set token="..."> in the <selection> of a timechart to set tokens, and then have other charts refer to those tokens as their time range? If so, I have issues with that approach, as described in my comments on the question "Can timechart zoom alter time range picker?".

The related question "How to "match zoom" from any chart on a dashboard" is attempting to achieve more or less the same thing, except that I want zooming to also update the time range picker.

If not, what technique are you referring to?

I would be happy to learn that my preconceptions based on using Kibana (Elastic Stack) are blinding me to how to easily achieve this syncing in Splunk.

0 Karma

PPape
Contributor

Okay now i got you. You want to have like 4 elements and independent on wich you use pan and zoom the others should change. I have to test it here. I'll come back to you later.

0 Karma

Graham_Hanningt
Builder

Thanks for persisting with this, much appreciated.

Strictly speaking, no: what you're suggesting is not what this question is about. This question is about something similar to Grafana's "shared crosshair", which highlights - by which I mean shows a marker, such as a vertical line - at the same point in time in other time-based charts as the one that you're currently "mousing over" (forgetting about touch devices, for now), without actually panning or zooming.

However, you hit a nerve with your "Pan and Zoom"-based answer, because I'm very interested in an answer to that (separate but related) question, too.

Regarding that question: yep, exactly as you say: I have a dashboard with a time range picker and various panels. Some of the panels display timecharts. When I zoom ("marquee select" a time range in) a timechart, I want the entire dashboard - the panels and the time range picker - to reflect that zoomed time range.

I'll come back to you later.

That's very kind of you, thank you!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...