topic Re: SLA Line on Chart in Splunk Search

SLA Line on Chart

hartfoml — Tue, 27 Dec 2011 16:13:07 GMT

I am using this search to get license use over 30 days

 index="summary_indexers" | timechart partial=f span=1d sum(kb) as KB | eval gb=round(KB/1048576,1) | convert timeformat="%A - %m/%d" ctime(_time) AS DATE | table DATE gb

This gives ma b bar chart with one bar per day.

I would like to put a RED SLA line at the license limit so that the managers can clearly see where the License SLA will be violated and how close we are to that line.

Re: SLA Line on Chart

dwaddle — Tue, 27 Dec 2011 20:35:18 GMT

Except for the RED part (which is configurable as part of the viewstate / dashboard config), this search adds in your SLA line:

index="summary_indexers" 
| eval sla=20 
| timechart partial=f span=1d sum(kb) as KB,max(sla) as SLA 
| eval gb=round(KB/1048576,1) 
| convert timeformat="%A - %m/%d" ctime(_time) AS DATE 
| table DATE gb SLA

Re: SLA Line on Chart

hartfoml — Tue, 27 Dec 2011 21:20:42 GMT

Thanks that did it

Re: SLA Line on Chart

kamal_jagga — Tue, 31 Mar 2015 23:33:04 GMT

Hi,

I have 10 services being displayed in a single chart. And i want to project 10 different SLAs for the different services.
If i use the below method, it gives me same sla for all.
| eval sla=20

Is there any way to do it.

Kindly advise.