topic Re: How to add a calculated values as threshold in a line chart? in Dashboards & Visualizations

How to add a calculated values as threshold in a line chart?

anooshac — Mon, 28 Mar 2022 10:59:40 GMT

Hi everyone,

I have a line chart of some tasks and its duration. I am trying to add average of the duration of all tasks as threshold.

|stats values(duration) as "Duration(Hr)" by Task|sort Task|stats avg(duration) as threshold

I am not getting any results from the query.I have previously added threshold as a fixed value. Is there any different method to add a threshold value which is calculated not fixed.

Re: How to add a calculated values as threshold in a line chart?

ITWhisperer — Mon, 28 Mar 2022 11:17:08 GMT

Use eventstats

|stats values(duration) as "Duration(Hr)" by Task|sort Task|eventstats avg('Duration(Hr)') as threshold

Re: How to add a calculated values as threshold in a line chart?

anooshac — Mon, 28 Mar 2022 11:25:34 GMT

Thanks!! It is working. Does the aggregate function only work with eventstats?

Re: How to add a calculated values as threshold in a line chart?

ITWhisperer — Mon, 28 Mar 2022 11:28:36 GMT

No, the aggregate function works for all the stats and chart commands, eventstats adds the field to the events in the pipeline, whereas stats replaces the events in the pipeline

Re: How to add a calculated values as threshold in a line chart?

anooshac — Mon, 28 Mar 2022 11:59:18 GMT

Thank you so much for the info.

Can you please suggest any resources which will help in increasing the Splunk knowledge..

Re: How to add a calculated values as threshold in a line chart?

ITWhisperer — Mon, 28 Mar 2022 15:28:28 GMT

Splunk provide various training and certification opportunities

Splunk Training & Certification | Splunk

You can also download and setup trail instances to try things out.

You could look through the answers provided here and other community channels to see how other people have approached various problems.

Re: How to add a calculated values as threshold in a line chart?

anooshac — Wed, 30 Mar 2022 04:44:58 GMT

Sure..Thank you so much for the info!!