An illustration

To illustrate a simple example, we can consider a timecount query within a Splunk dashboard. Opening an existing dashboard, we see the following query that counts the occurrences of the text error within machine logs that are indexed in source type's names starting with tm1:

sourcetype="tm1*" error | timechart count 

Suppose we know that there are times when various ETL processes are inactive and want to correlate these events with the count of errors occurring. We can create the following event annotation query:

<query>sourcetype="tm1*" error | timechart count</query> 
             <earliest>-30week</earliest> 
          <latest>-1weeks</latest> 
               <sampleRatio>1</sampleRatio> 

We then add it to the XML of our dashboard (using search type="annotation"):

When we save our dashboard, we can see our results:

You can get event context for any time chart (line, column, or area), and event annotation markers and labels can be pulled from sources such as log data, lookup files, or external sources. All together in single view!