https://community.splunk.com/t5/Splunk-Search/How-to-get-the-overall-average-and-average-per-5-minutes-on-a/m-p/447471#M126833 <P>Does this work for you ?</P> <PRE><CODE>service=service1 |fields _time,SERVICE_TIME_TAKEN|eventstats avg(SERVICE_TIME_TAKEN) as overall_service_time | timechart span=5m avg(SERVICE_TIME_TAKEN) as service_time ,first(overall_service_time) as overall_service_time </CODE></PRE> Wed, 06 Jun 2018 15:01:31 GMT renjith_nair 2018-06-06T15:01:31Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-overall-average-and-average-per-5-minutes-on-a/m-p/447470#M126832 <P>I have a timechart which currently outputs the average value for every 5 minutes over a period of time for the field "SERVICE_TIME_TAKEN" using following query.</P> <PRE><CODE>service=service1 | timechart span=5m avg(SERVICE_TIME_TAKEN) | fillnull </CODE></PRE> <P>I want to add a second line on this same time chart which shows the overall average value. This would be a single value which draws a straight line on the chart. </P> <P>If I make a separate query, I am able to get this single value using following query. </P> <PRE><CODE>service=service1 | chart avg(SERVICE_TIME_TAKEN) </CODE></PRE> <P>How can I combine these 2 queries to to show the data on a single time chart? </P> <P>Tried the following but it only shows the line with the 5 min average. </P> <PRE><CODE>service=service1 | timechart span=5m avg(SERVICE_TIME_TAKEN) as service_time | eventstats avg(SERVICE_TIME_TAKEN) as overall_service_time | fillnull </CODE></PRE> <P>This image depicts what I am looking for.<BR /> Orange line is the 5 mins average and blue line is the overall average. <BR /> <IMG src="https://community.splunk.com/storage/temp/251885-chart.png" alt="chart" /></P> Tue, 29 Sep 2020 19:55:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-overall-average-and-average-per-5-minutes-on-a/m-p/447470#M126832 angersleek 2020-09-29T19:55:20Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-overall-average-and-average-per-5-minutes-on-a/m-p/447471#M126833 <P>Does this work for you ?</P> <PRE><CODE>service=service1 |fields _time,SERVICE_TIME_TAKEN|eventstats avg(SERVICE_TIME_TAKEN) as overall_service_time | timechart span=5m avg(SERVICE_TIME_TAKEN) as service_time ,first(overall_service_time) as overall_service_time </CODE></PRE> Wed, 06 Jun 2018 15:01:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-overall-average-and-average-per-5-minutes-on-a/m-p/447471#M126833 renjith_nair 2018-06-06T15:01:31Z