topic Re: line of threshold in timechart graph in Dashboards & Visualizations

line of threshold in timechart graph

faribole — Wed, 13 Feb 2019 08:29:05 GMT

My request is simple

sourcetype="mysourcetype" login OK | timechart count by host

I want to visualize the threshold value, so i add a field thresold with value of 350

My new request is :

sourcetype="mysourcetype" login OK | eval threshold=350 | timechart count max(threshold) by host

but I have 10 host and splunk is drawing 10 superposed lines of threshold or i want to show only one line at 350

how can i do this ?

DMohn — Wed, 13 Feb 2019 08:38:03 GMT

You have to format the visualization...

Go to Format => Chart Overlay => Overlay and choose your threshold field as overlay parameter.

whrg — Wed, 13 Feb 2019 08:43:16 GMT

Also, I would move the eval expression to the end of the search query. Something like this:

sourcetype="mysourcetype" login OK | timechart count by host | eval threshold=350

DMohn — Wed, 13 Feb 2019 08:51:42 GMT

You are totally right here 🙂 Makes even more sense!

faribole — Wed, 13 Feb 2019 09:07:16 GMT

in Overlay section, it prupose me 10 max(threshold), one per host.
I choose one but it didn't change the graph

faribole — Wed, 13 Feb 2019 09:09:55 GMT

This is the good request.
Thanks

DMohn — Wed, 13 Feb 2019 09:19:48 GMT

Try changing the query as suggested below by @whrg

sourcetype="mysourcetype" login OK | timechart count by host | eval threshold=350

Then go to Format => Chart Overlay => Overlay and choose the threshold field. This will display a line in your chart.

DMohn — Wed, 13 Feb 2019 09:20:32 GMT

Could you please accept the answer as correct if it helped you?