https://community.splunk.com/t5/Splunk-Search/Constant-Horizontal-Line-On-Line-Chart/m-p/37764#M8516 <P>I know this is a really old post- but couldn't find a similar question. </P> <P>The "| eval SLA=5 " works fine, but how could you do it if you wanted the value "5" to come from a search? eg:</P> <P>splunk_server=splunk*unix* index=_internal sourcetype="splunkd" component="LicenseUsage" pool="EFX Prod" NOT type=RolloverSummary | eval Gb=b/1024/1024/1024| timechart span=1h sum(Gb) as total | streamstats sum(total) AS cumulative_total | predict cumulative_total | appendcols [| rest /services/licenser/pools | where like(title,"%EFX Prod%") | eval quota=quota/1024/1024/1024| fields quota] | eval quota2=quota| eval quota=150</P> <P>Here I'm trying to add a horizontal line for the quota, ie the result from:<BR /> | rest /services/licenser/pools | where like(title,"%EFX Prod%") | eval quota=quota/1024/1024/1024| fields quota</P> <P>"quota" works fine<BR /> "quota2" just displays as a single point</P> Mon, 28 Sep 2020 18:43:06 GMT kyleharrison 2020-09-28T18:43:06Z https://community.splunk.com/t5/Splunk-Search/Constant-Horizontal-Line-On-Line-Chart/m-p/37760#M8512 <P>I'm putting together a line chart measuring application response time in milliseconds. What I would like to is put a horizontal line on the chart which is a constant value. This represents an SLA. This will allow us to determine whether the SLA has been exceeded/breached. Any thoughts on how to do this</P> Thu, 26 Aug 2010 19:36:59 GMT https://community.splunk.com/t5/Splunk-Search/Constant-Horizontal-Line-On-Line-Chart/m-p/37760#M8512 sajbutler 2010-08-26T19:36:59Z https://community.splunk.com/t5/Splunk-Search/Constant-Horizontal-Line-On-Line-Chart/m-p/37761#M8513 <P>You can simply add a series to the chart:</P> <PRE><CODE>... | eval SLA=5 | timechart avg(responsetime) as responsetime, first(SLA) as SLA </CODE></PRE> Thu, 26 Aug 2010 20:19:44 GMT https://community.splunk.com/t5/Splunk-Search/Constant-Horizontal-Line-On-Line-Chart/m-p/37761#M8513 gkanapathy 2010-08-26T20:19:44Z https://community.splunk.com/t5/Splunk-Search/Constant-Horizontal-Line-On-Line-Chart/m-p/37762#M8514 <P>I'd usually add the series after the fact:</P> <P>... | timechart avg(responsetime) as responsetime | eval SLA = 5</P> Thu, 26 Aug 2010 21:58:32 GMT https://community.splunk.com/t5/Splunk-Search/Constant-Horizontal-Line-On-Line-Chart/m-p/37762#M8514 Stephen_Sorkin 2010-08-26T21:58:32Z https://community.splunk.com/t5/Splunk-Search/Constant-Horizontal-Line-On-Line-Chart/m-p/37763#M8515 <P>Having the eval command afterwards allows the search to be accelerated.</P> Mon, 14 Oct 2013 14:29:41 GMT https://community.splunk.com/t5/Splunk-Search/Constant-Horizontal-Line-On-Line-Chart/m-p/37763#M8515 AlexMcDuffMille 2013-10-14T14:29:41Z https://community.splunk.com/t5/Splunk-Search/Constant-Horizontal-Line-On-Line-Chart/m-p/37764#M8516 <P>I know this is a really old post- but couldn't find a similar question. </P> <P>The "| eval SLA=5 " works fine, but how could you do it if you wanted the value "5" to come from a search? eg:</P> <P>splunk_server=splunk*unix* index=_internal sourcetype="splunkd" component="LicenseUsage" pool="EFX Prod" NOT type=RolloverSummary | eval Gb=b/1024/1024/1024| timechart span=1h sum(Gb) as total | streamstats sum(total) AS cumulative_total | predict cumulative_total | appendcols [| rest /services/licenser/pools | where like(title,"%EFX Prod%") | eval quota=quota/1024/1024/1024| fields quota] | eval quota2=quota| eval quota=150</P> <P>Here I'm trying to add a horizontal line for the quota, ie the result from:<BR /> | rest /services/licenser/pools | where like(title,"%EFX Prod%") | eval quota=quota/1024/1024/1024| fields quota</P> <P>"quota" works fine<BR /> "quota2" just displays as a single point</P> Mon, 28 Sep 2020 18:43:06 GMT https://community.splunk.com/t5/Splunk-Search/Constant-Horizontal-Line-On-Line-Chart/m-p/37764#M8516 kyleharrison 2020-09-28T18:43:06Z https://community.splunk.com/t5/Splunk-Search/Constant-Horizontal-Line-On-Line-Chart/m-p/37765#M8517 <P>figured it out:</P> <P>splunk_server=splunk*unix* index=_internal sourcetype="splunkd" component="LicenseUsage" pool="EFX Prod" NOT type=RolloverSummary | eval Gb=b/1024/1024/1024| timechart span=1h sum(Gb) as total | streamstats sum(total) AS cumulative_total | predict cumulative_total | eval quota = [| rest /services/licenser/pools | where like(title,"%EFX Prod%") | eval quota=quota/1024/1024/1024| fields quota | head 1 | return $quota] </P> Mon, 28 Sep 2020 18:43:09 GMT https://community.splunk.com/t5/Splunk-Search/Constant-Horizontal-Line-On-Line-Chart/m-p/37765#M8517 kyleharrison 2020-09-28T18:43:09Z https://community.splunk.com/t5/Splunk-Search/Constant-Horizontal-Line-On-Line-Chart/m-p/37766#M8518 <P>I managed to fill the gaps with the make <STRONG>continuous</STRONG> and <STRONG>fullnull</STRONG> commands</P> <P>... | eval SLA=5 | timechart avg(responsetime) as responsetime, first(SLA) as SLA <STRONG>| table _time, responsetime, sla | makecontinuous _time span=10m | fillnull value=5 SLA</STRONG><BR /> ,I managed to fill the gaps with the make <STRONG>continuous</STRONG> and <STRONG>fullnull</STRONG> commands</P> <P>| eval SLA=5 | timechart avg(responsetime) as responsetime, first(SLA) as SLA<BR /> <STRONG>| table _time, responsetime, sla | makecontinuous _time span=10m | fillnull value=5 SLA</STRONG></P> Sat, 17 Dec 2016 09:57:38 GMT https://community.splunk.com/t5/Splunk-Search/Constant-Horizontal-Line-On-Line-Chart/m-p/37766#M8518 splunkmaesi 2016-12-17T09:57:38Z