topic how to add a horizontal line to a column/bar chart in Splunk Search

how to add a horizontal line to a column/bar chart

myli12 — Tue, 29 Jan 2013 00:51:39 GMT

I want to draw a horizontal line across the following column time chart made out of a saved search

| timechart span=1mon avg(numDropPkt) as avgDrop BY host

Adding " |eval threashold = 100" gave me a few more column bars of value 100 (and the number of newly added columns is equal to the number of months searched), not a horizonal line.

The following link asked the same question, but the answer is very high level.

http://splunk-base.splunk.com/answers/71142/horizontal-line-in-flash-bar-chart

Re: how to add a horizontal line to a column/bar chart

lguinn2 — Tue, 29 Jan 2013 05:59:38 GMT

Try this:

yoursearchhere
| append [ sourcetype=yoursourcetype  | addinfo | where _time >= info_min_time AND time <= info_max_time
    | eval numDropPkt = 100 | eval host="Threshold" ]
| timechart span=1mon avg(numDropPkt) as avgDrop by host

BTW, the only purpose of the sourcetype=yoursourcetype is to obtain some events to transform into the values that I want. Any sourcetype would work if it has at least one event per month over the duration that you are searching - and fewer events would be better.

Re: how to add a horizontal line to a column/bar chart

myli12 — Tue, 05 Feb 2013 00:39:25 GMT

Thanks! I tried the scripts and ensured "sourcetype=yoursourcetype" has events per month, however, there is no horizontal line showing up in the chart.

Re: how to add a horizontal line to a column/bar chart

tfletcher_splun — Tue, 05 Feb 2013 00:51:03 GMT

http://splunk-base.splunk.com/answers/9053/example-of-chart-overlay

There is an answer for how to do it with a flashchart. It cannot be done with a JSChart.

Re: how to add a horizontal line to a column/bar chart

tfletcher_splun — Tue, 05 Feb 2013 00:53:37 GMT

This is how to format for charting use. You still need to have the data as results from your search be it from an append or from an eval.

Re: how to add a horizontal line to a column/bar chart

lguinn2 — Tue, 05 Feb 2013 10:30:54 GMT

How many hosts are you trying to show in this chart?

Re: how to add a horizontal line to a column/bar chart

myli12 — Tue, 05 Feb 2013 23:17:28 GMT

It was 9 in one example but can vary.

Re: how to add a horizontal line to a column/bar chart

lguinn2 — Wed, 06 Feb 2013 21:43:14 GMT

Try this

And look at the Table View tab.

Re: how to add a horizontal line to a column/bar chart

myli12 — Fri, 08 Feb 2013 00:55:42 GMT

Thank you very much for your willingness to help. There is still no line show in the column graph. I am not sure why the table view tab, as I'd like a graph rather than a table report. And also since I do not understand the logic behind the script, I cannot really test/twist your script to fit my data. It could be just I did not use your script correctly.

Re: how to add a horizontal line to a column/bar chart

rabitoblanco — Fri, 27 Mar 2015 20:43:36 GMT

I am trying to do a similar thing here-- simply draw a line across my graph showing a "full_capacity" line.
I've tried
mysearch | eval capacity=100 | stats max(capacity) to no avail.
Also capacity=tonumber(100) is no different.
A new way to do this?
Alternatively, to clearly label the top of my chart's Y-axis? Choosing the value in the dashboard UI doesn't label the top.

Thanks!