https://community.splunk.com/t5/Splunk-Search/Overlay-an-average-line-on-a-bar-graph-of-counts/m-p/333014#M99044 <P>I have a search <CODE>index=safes TransactionCode=DOPN OR TransactionCode=DCLO Details="Door A Opened" OR Details="Door A Closed" <BR /> | transaction open_close startswith=DOPN endswith=DCLO maxevents=2 | search eventcount=2<BR /> | stats count(duration) as Events by Location</CODE> . </P> <P>This gives me the number of relevant events by Location for the month I'm looking at. I want to display an average value line across the bar graph. However changing the last command to <CODE>|stats count(duration) as Events, avg(Events) as Event_avg by Location</CODE> doesn't create a value for Event avg and doesn't let me select Event avg as an overlay on the graph. I've seen many questions similar to this but the answers all seemed to refer to splitting up events by <CODE>_time</CODE> rather than some other field such as Location.</P> Tue, 25 Jul 2017 17:19:40 GMT ellenbytech 2017-07-25T17:19:40Z https://community.splunk.com/t5/Splunk-Search/Overlay-an-average-line-on-a-bar-graph-of-counts/m-p/333014#M99044 <P>I have a search <CODE>index=safes TransactionCode=DOPN OR TransactionCode=DCLO Details="Door A Opened" OR Details="Door A Closed" <BR /> | transaction open_close startswith=DOPN endswith=DCLO maxevents=2 | search eventcount=2<BR /> | stats count(duration) as Events by Location</CODE> . </P> <P>This gives me the number of relevant events by Location for the month I'm looking at. I want to display an average value line across the bar graph. However changing the last command to <CODE>|stats count(duration) as Events, avg(Events) as Event_avg by Location</CODE> doesn't create a value for Event avg and doesn't let me select Event avg as an overlay on the graph. I've seen many questions similar to this but the answers all seemed to refer to splitting up events by <CODE>_time</CODE> rather than some other field such as Location.</P> Tue, 25 Jul 2017 17:19:40 GMT https://community.splunk.com/t5/Splunk-Search/Overlay-an-average-line-on-a-bar-graph-of-counts/m-p/333014#M99044 ellenbytech 2017-07-25T17:19:40Z https://community.splunk.com/t5/Splunk-Search/Overlay-an-average-line-on-a-bar-graph-of-counts/m-p/333015#M99045 <P>Add at the end... </P> <PRE><CODE> | eventstats avg(Events) as Event_avg </CODE></PRE> <P>That will put the same overall average on every event. </P> <P>Haven't done overlays myself, so that only gets you halfway there, but the data will be available anyway. </P> Tue, 25 Jul 2017 17:35:30 GMT https://community.splunk.com/t5/Splunk-Search/Overlay-an-average-line-on-a-bar-graph-of-counts/m-p/333015#M99045 DalJeanis 2017-07-25T17:35:30Z