topic timechart with SLA value in Splunk Search

timechart with SLA value

hartfoml — Wed, 16 Jan 2013 20:03:11 GMT

I would like to create a timechart with an SLA value.

I have tried this search sourcetype=foo | eval sla=50 | timechart span=15m count | table count sla

this did not work reliably.

Can anyone suggest a better way

Re: timechart with SLA value

jonuwz — Wed, 16 Jan 2013 21:58:21 GMT

This is probably what you need :

search sourcetype=foo | timechart span=15m count | eval sla=50

Re: timechart with SLA value

hartfoml — Fri, 18 Jan 2013 22:19:35 GMT

Thanks Jonuwx

Re: timechart with SLA value

MuS — Thu, 25 Jul 2013 13:32:28 GMT

Hi, using this eval after timechart works perfect. But if you create a report view out of it, you are no longer able to drill down -> PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'eval' command

How can this be avoid?

Re: timechart with SLA value

MuS — Tue, 06 Aug 2013 07:57:48 GMT

found one way to be able to drill down with sla line, use the eval before the timechart like this:

… | eval b=50 | timechart values(b) as base count by foo