Community:Search Report: How to Add a Range Marker by Advanced XML
From Splunk Wiki
This is an example to add a highlighted range in a chart by editing an advanced xml. This feature is called Range Marker. Unfortunately Range Marker is static range.
The following example is a chart with range marker between value of 500 and 700.
The important points for Range Marker feature are
1. The following part is important to overlay the two charts, @chart and @rangeMarker.
<param name="charting.layout.charts">[@chart,@rangeMarker]</param>
2. The minimumValue and maximumValue values are static, not dynamic.
The XML for the example chart above is as follows.
# # RangeMarker Example # <view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html"> <label>RangeMarker Test</label> <module name="AccountBar" layoutPanel="appHeader" /> <module name="AppBar" layoutPanel="navigationHeader" /> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module> <module name="Message" layoutPanel="messaging"> <param name="filter">splunk.search.job</param> <param name="clearOnJobDispatch">True</param> <param name="maxSize">1</param> </module> <module name="TitleBar" layoutPanel="viewHeader"> <param name="actionsMenuFilter">dashboard</param> </module> <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="RanageMarkerTest" autoRun="True"> <param name="search">index=_internal eps "group=per_source_thruput" NOT filetracker | eval events=eps*kb/kbps | timechart fixedrange=t span=1m sum(events) by series</param> <param name="earliest">-15m@m</param> <param name="groupLabel">RanageMarkerTest</param> <module name="ViewstateAdapter"> <param name="savedSearch">Messages by minute in the last 15min</param> <module name="HiddenFieldPicker"> <param name="strictMode">True</param> <module name="JobProgressIndicator"> <module name="EnablePreview"> <param name="enable">True</param> <param name="display">False</param> <module name="HiddenChartFormatter"> <param name="charting.chart">line</param> <param name="charting.axisTitleX.visibility">collapsed</param> <param name="charting.chart.nullValueMode">zero</param> <param name="charting.rangeMarker">rangeMarker</param> <param name="charting.rangeMarker.axis">@axisY</param> <param name="charting.rangeMarker.orientation">y</param> <param name="charting.rangeMarker.minimumValue">500</param> <param name="charting.rangeMarker.maximumValue">700</param> <param name="charting.rangeMarker.lineBrush">solidFill</param> <param name="charting.rangeMarker.lineBrush.color">0xFF0000</param> <param name="charting.rangeMarker.lineBrush.alpha">0.5</param> <param name="charting.rangeMarker.innerFillBrush">solidFill</param> <param name="charting.rangeMarker.innerFillBrush.color">0xFF0000</param> <param name="charting.rangeMarker.innerFillBrush.alpha">0.5</param> <param name="charting.layout.charts">[@chart,@rangeMarker]</param> <module name="FlashChart"> <param name="width">100%</param> </module> <module name="ConvertToDrilldownSearch"> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> <module name="ViewRedirectorLink"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> </module> </module> </view>