topic Re: How can I display only 1 value in a timechart that uses a by in Splunk Search

How can I display only 1 value in a timechart that uses a by

Splunked_Kid — Thu, 24 Oct 2024 20:36:48 GMT

Hello
how can I display only 1 value of these 3 "maxCapacitMachine" results (which are the same in all 3 cases) in a BY timechart?

Re: How can I display only 1 value in a timechart that uses a by

MuS — Thu, 24 Oct 2024 21:50:34 GMT

Hi there,

if your max value is static, you could do something like this:

index=_internal sourcetype=* | timechart span=1h count by sourcetype | eval max=10000000

and this will produce 1 max line on the graph like this:

Hope this helps ...

cheers, MuS

Re: How can I display only 1 value in a timechart that uses a by

Splunked_Kid — Thu, 24 Oct 2024 22:01:05 GMT

ok but max is a value that I get from the index and not a value that I attribute. My problem is that the value I get from the index is the same for all 3 LPARs, I only want to display it 1 time.

Re: How can I display only 1 value in a timechart that uses a by

Splunked_Kid — Thu, 24 Oct 2024 22:03:00 GMT

Re: How can I display only 1 value in a timechart that uses a by

MuS — Thu, 24 Oct 2024 22:48:44 GMT

Please add this

| eval foo=0 | foreach max* [ eval foo='<<FIELD>>'] | fields - max* | rename foo AS max

at the end of your SPL 🙂

Re: How can I display only 1 value in a timechart that uses a by

Splunked_Kid — Fri, 25 Oct 2024 12:10:34 GMT

It works! Thank you very much MuS!