Community:Search Report: How to Add a Range Marker by Advanced XML

From Splunk Wiki

Jump to: navigation, search

This is an example to add a highlighted range in a chart by editing an advanced xml. This feature is called Range Marker. Unfortunately Range Marker is static range.

The following example is a chart with range marker between value of 500 and 700.

Chart rangemarker.png


The important points for Range Marker feature are

1. The following part is important to overlay the two charts, @chart and @rangeMarker.

             <param name="charting.layout.charts">[@chart,@rangeMarker]</param>

2. The minimumValue and maximumValue values are static, not dynamic.


The XML for the example chart above is as follows.

#
#  RangeMarker Example
#
<view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
  <label>RangeMarker Test</label>
  <module name="AccountBar" layoutPanel="appHeader" />
  <module name="AppBar" layoutPanel="navigationHeader" />
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
  </module>
  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
  </module>
  <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="RanageMarkerTest" autoRun="True">
    <param name="search">index=_internal eps "group=per_source_thruput" NOT filetracker 
                         | eval events=eps*kb/kbps 
                         | timechart fixedrange=t span=1m sum(events) by series</param>
    <param name="earliest">-15m@m</param>
    <param name="groupLabel">RanageMarkerTest</param>
    <module name="ViewstateAdapter">
      <param name="savedSearch">Messages by minute in the last 15min</param>
      <module name="HiddenFieldPicker">
        <param name="strictMode">True</param>
        <module name="JobProgressIndicator">
          <module name="EnablePreview">
            <param name="enable">True</param>
            <param name="display">False</param>
            <module name="HiddenChartFormatter">
              <param name="charting.chart">line</param>
              <param name="charting.axisTitleX.visibility">collapsed</param>
              <param name="charting.chart.nullValueMode">zero</param>
              <param name="charting.rangeMarker">rangeMarker</param>
              <param name="charting.rangeMarker.axis">@axisY</param>
              <param name="charting.rangeMarker.orientation">y</param>
              <param name="charting.rangeMarker.minimumValue">500</param>
              <param name="charting.rangeMarker.maximumValue">700</param>
              <param name="charting.rangeMarker.lineBrush">solidFill</param>
              <param name="charting.rangeMarker.lineBrush.color">0xFF0000</param>
              <param name="charting.rangeMarker.lineBrush.alpha">0.5</param>
              <param name="charting.rangeMarker.innerFillBrush">solidFill</param>
              <param name="charting.rangeMarker.innerFillBrush.color">0xFF0000</param>
              <param name="charting.rangeMarker.innerFillBrush.alpha">0.5</param>
              <param name="charting.layout.charts">[@chart,@rangeMarker]</param>
              <module name="FlashChart">
                <param name="width">100%</param>
              </module>
              <module name="ConvertToDrilldownSearch">
                <module name="ViewRedirector">
                  <param name="viewTarget">flashtimeline</param>
                </module>
              </module>
              <module name="ViewRedirectorLink">
                <param name="viewTarget">flashtimeline</param>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</view>

Personal tools
Hot Wiki Topics


About Splunk >
  • Search and navigate IT data from applications, servers and network devices in real-time.
  • Download Splunk