Need assistance to show baseline in line chart if using trellis

dixa0123 — Tue, 20 Aug 2024 06:51:33 GMT

Hello everyone,

I have created dashboard that shows total log volumes for different sources across 7 days. I am using line chart and trellis. As shown in pic, I want to add median/average value of logs as horizonal red line. Is there a way to achieve it ? Final aim is to be able to observe pattern and median/avg log volumes of certain week that ultimately helps to define baseline of log volume for each source.

below is the SPL I am using,

| tstats count as log_count where index=myindex AND hostname="colla" AND source=* earliest=--7d@d latest=now by _time, source | timechart span=1d sum(log_count) by source

Any suggestions would be highly appreciated. Thanks

Re: Need assistance to show baseline in line chart if using trellis

tscroggins — Sat, 02 Nov 2024 17:24:43 GMT

Hi @dixa0123,

SplunkWeb uses hidden field attributes to identify aggregations for trellis mode in Simple XML. (I haven't tried this in Dashboard Studio.) Here's a sample search that summarizes data, calculates a global mean, reformats the results, and then uses the global mean as an overlay in trellis mode:

index=_internal | timechart limit=10 span=1m usenull=f useother=f count as x by component | untable _time component x ``` calculate a global mean ``` | eventstats avg(x) as tmp ``` append temporary events to hold the mean as a series ``` | appendpipe [| stats values(tmp) as x by _time | eval component="tmp" ] ``` reformat the results for trellis ``` | xyseries _time component x ``` disassociate the tmp field from aggregations to use as an overlay ``` | eval baseline=tmp ``` remove the tmp field ``` | fields - tmp

topic Re: Need assistance to show baseline in line chart if using trellis in Dashboards & Visualizations

Need assistance to show baseline in line chart if using trellis

Re: Need assistance to show baseline in line chart if using trellis