Is there a way to create two charts with a time range that stays in sync?

[paulerlong]

I want to create multiple charts that have the same time range. That way I can correlate between the two. For instance a CPU utilization in one chart with a second change that shows number of messages filterable by messages. Then I can select a component and see if the number of messages correlate to a CPU spike. Ideally you could zoom in and all charts would update.

I was able to come close by creating a query that determined the range of time, and saving the min and max time frame. However something like charting.axisX.minimumNumber doesn't work for timeline charts.

Is there anyway to accomplish this?

Thanks -Paul

[niketn]

@paulerlong one of the ways would be to use Horizon Chart Custom Visualization

Within Splunk Dashboard you can try out the JS based approach proposed by @rjthibod https://answers.splunk.com/answers/568487/dynamic-syncing-of-timechart-zoom-and-time-picker.html

Based on your use case try out the approaches and confirm!

[paulerlong]

I want to try the Horizon Chart, but there are no instructions on how to install it. The details tab has no info, and I can't find anything to tell me how to install custom visualizations in general. I'm on Windows, how to I install the .tar file?

For the JS approach I'm not sure I'm using it properly. I've installed it and added the sections. But all that happens is that it creates a selection area with handles. Isn't it supposed to zoom in the selection on all panels like origin video?

[niketn]

@paulerlong installing Custom Visualization will follow the steps same as how you would install any other App within Splunk. Depending on the environment setup the answer to the exact question may differ. So do following Splunk Documentation for the App setup on your SH/SHC.

[paulerlong]

I was able to figure out how to install the custom visualization. To help others, the only reference I could find is in this video (https://www.bing.com/videos/search?q=how+to+install+tgz+in+splunk+for+windows&docid=6080272283001164...). I could not find documentation on this procedure.

As for the JS approach I still can't get it working. I understand now that the .JS file is not being found at all. I then tried a simpler example from https://answers.splunk.com/answers/579537/how-to-use-javascript-code-in-splunk-cloud-dashboa.html, and I could not get that working either. In that example the F12 debugging states:

Failed to load resource: 8000/en-US/static/@a6754d8441bf/app/hello-splunkjs/hello_world.js:1 the server the server responded with a status of 404 (Not Found)

The message is confusing because that path doesn't map to my E:/Program Files/Splunk/apps directory. Also there's an etc/apps directory and a etc/users/paul directory which can both have App stuff in them. I don't understand where all the associated files go for that example. Can you help me understand?