Splunk Search

how to combine more than three types of charts in one chart.

jenny_life
Path Finder

hello everyone,

I'd like to know how to combine three types of charts in one chart.
I'd like to make just one chart using column chart, line chart, area chart.
I've known that if overlay option , two types of charts can combine in one chart.
But I've never seen the chart that more than three types of charts are combined in one chart.
I appreciate if you give me some information.
Thank you in advance.
alt text

0 Karma

niketn
Legend

@jenny_life I would also be interested in in your use case for three visualizations in one chart. Built in Chart Overlay can add Line Series over existing Chart be it Column or Area.

But if you really want all three charts you can use Custom Visualization API to build your own visualization using Highcharts JS Library.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jenny_life
Path Finder

thank you for your answer.

Have you ever created this type of chart using Custom Visualization API and Highcharts JS Library?
It seems to be very difficult.
I'm sorry to say that, Isn't there a simple other way?
(FYI, i'm using the Simple XML)

0 Karma

niketn
Legend

@jenny_life yes creating a Custom Visualization takes some effort. However, end result is a Custom Visualization App which can be reused and distributed.

Based on your screenshot, for your current requirement see where the Simple XML Chart Configuration charting.fieldDashStyles, which is available post Splunk Enterprise 7.0, suits the need or not. Through this setting for a Line Series you can apply different stroke styles to distinguish between the series (beside color applied through charting.fieldColors).

You can check out Splunk Enterprise 7.0 Overview app to check out some example of this new Chart configuration.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@jenny_life , were you able to check out the charting.fieldDashStyles chart configuration introduced in Splunk Enterprise 7.0+

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jenny_life
Path Finder

Yes, I checked it out.
But I didn't implement to merge three types of charts yet.
For merging three charts , I need time to understand what these are.(Custom Visualization API and Highcharts JS Library)
But I'm so glad to know that merging three charts is possible,
Thank you

0 Karma

niketn
Legend

@jenny_life the approach with fieldDashStyle will not implement three different charts. It will give Line Series some different strokes so that you can visually distinguish them.

Custom Visualization API has a documentation to set up a bare minimal visualization i.e. Horse Shoe Meter. However, you can use the same approach to include Highcharts JS library. Splunk's Column, Line and Area charts that you are interested in are built on top of Highcharts. So, you would need a combination of both to build the same up.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jenny_life
Path Finder

yes, I understand what 'charting.fieldDashStyles' is.
That is just option for distinguishing for each line on the line chart.

Apart from that option, I'm trying to understand what Custom Visualization API and Highcharts JS library are.
It doesn't seem like simple way. 🙂

Thank you for your answer.

0 Karma

adonio
Ultra Champion

hello there,
can you elaborate on the requirement? please consider that each view is powered by a single search? what is your goal? how do you envision the final outcome? a screenshot will be nice
also did you take a look at the dashboard example app? https://splunkbase.splunk.com/app/1603/
hope it helps

0 Karma

jenny_life
Path Finder

Thank you for your attention.
I attached the screenshot what i want to do.

I'd like to make this type of chart in dashboard.
If I use basic option that Splunk offers , I can merge only two types of charts. (overlay option) .
I'd like to know if there is a way of utilizing html , css etc.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...