https://community.splunk.com/t5/Splunk-Search/get-the-values-in-each-line/m-p/707293#M239241 <P>Hi i have a below query where I'm calculating the total prod server count in first dataset and in second dataset I'm plottting a timechart for the server count. what i want to display is a line chart with total prod server showing as threshold and line and the below line chart as server count</P> <LI-CODE lang="markup">index=data sourcetype="server" | rex field=_raw "server=\"(?&lt;EVENT_CODE&gt;[^\"]*)" | search [ | inputlookup prodata_eventcode.csv | fields EVENT_Code ] | stats dc(host_name) as server_prod_count |rename | append [ | search index=appdata source=appdata_value | rex field=value "\|(?&lt;Item&gt;[^\|]+)?\|(?&lt;EVENT_CODE&gt;[^\|]+)|(?&lt;PROD_Count&gt;[^\|]+)?" | dedup DATE,EVENT_CODE | timechart span=1d sum(PROD_Count) as SERVER_COUNT] | table _time,local_PROD_COUNT,snow_prod_count | rename DYNA_PROD_COUNT as SERVER_COUNT,snow_prod_count as Threshold</LI-CODE> <P>Question is how can&nbsp; i get the threshold value in all the rows so that i can plot threshold vs server count in the line graph&nbsp;</P> <P>Below is the snapshot&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="secure_0-1734618949170.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/33914iC8C7034986A2D82F/image-size/medium?v=v2&amp;px=400" role="button" title="secure_0-1734618949170.png" alt="secure_0-1734618949170.png" /></span></P> <P>&nbsp;</P> Thu, 19 Dec 2024 15:14:43 GMT secure 2024-12-19T15:14:43Z https://community.splunk.com/t5/Splunk-Search/get-the-values-in-each-line/m-p/707293#M239241 <P>Hi i have a below query where I'm calculating the total prod server count in first dataset and in second dataset I'm plottting a timechart for the server count. what i want to display is a line chart with total prod server showing as threshold and line and the below line chart as server count</P> <LI-CODE lang="markup">index=data sourcetype="server" | rex field=_raw "server=\"(?&lt;EVENT_CODE&gt;[^\"]*)" | search [ | inputlookup prodata_eventcode.csv | fields EVENT_Code ] | stats dc(host_name) as server_prod_count |rename | append [ | search index=appdata source=appdata_value | rex field=value "\|(?&lt;Item&gt;[^\|]+)?\|(?&lt;EVENT_CODE&gt;[^\|]+)|(?&lt;PROD_Count&gt;[^\|]+)?" | dedup DATE,EVENT_CODE | timechart span=1d sum(PROD_Count) as SERVER_COUNT] | table _time,local_PROD_COUNT,snow_prod_count | rename DYNA_PROD_COUNT as SERVER_COUNT,snow_prod_count as Threshold</LI-CODE> <P>Question is how can&nbsp; i get the threshold value in all the rows so that i can plot threshold vs server count in the line graph&nbsp;</P> <P>Below is the snapshot&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="secure_0-1734618949170.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/33914iC8C7034986A2D82F/image-size/medium?v=v2&amp;px=400" role="button" title="secure_0-1734618949170.png" alt="secure_0-1734618949170.png" /></span></P> <P>&nbsp;</P> Thu, 19 Dec 2024 15:14:43 GMT https://community.splunk.com/t5/Splunk-Search/get-the-values-in-each-line/m-p/707293#M239241 secure 2024-12-19T15:14:43Z https://community.splunk.com/t5/Splunk-Search/get-the-values-in-each-line/m-p/707299#M239243 <P>From where you are, you could simply do something like this</P><LI-CODE lang="markup">| filldown Threshold</LI-CODE> Thu, 19 Dec 2024 15:08:25 GMT https://community.splunk.com/t5/Splunk-Search/get-the-values-in-each-line/m-p/707299#M239243 ITWhisperer 2024-12-19T15:08:25Z