Alerting

How to modify my search to display thresholds from column values in a line chart?

valentinv
Explorer

Hi

I have the following search:

index=myIndex Type="myType" | table Column1, Column2

Also I want to display two thresholds on line chart and values are in different columns. These thresholds can have different values.

So, if I write like this:

index=myIndex Type="myType" | table Column1, Column2 | eval Threshold1=25 | eval ThreShold2=75

...thresholds appear on line chart with different colors (that's exactly what I need).

But how can I write the search to look for thresholds in Thresholds1 and Thresholds2 columns and also to be visible on line chart?

Thanks!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

I think you're already there. Just run this search, Go to visualization section, select chart type as column. Go to Visualization Format option -> Chart overlay and add both Threshold1 and Threshold2 field as overlay field. This way Column1 and Column2 will be displayed as columns and Threshold1 and Threshold2 would come as horizontal line chart.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

I think you're already there. Just run this search, Go to visualization section, select chart type as column. Go to Visualization Format option -> Chart overlay and add both Threshold1 and Threshold2 field as overlay field. This way Column1 and Column2 will be displayed as columns and Threshold1 and Threshold2 would come as horizontal line chart.

valentinv
Explorer

I don't know if is ok to post here or should open another topic but based on issue above...

I need to monitor a csv file in Splunk with following structure:

ReportDateTime, Value1, Value2, Value3, Threshold1, Threshold2
2016-10-10, 0, 1, 2, 4, 4
2016-10-10, 3, 4, 5, 4, 4

2016-10-10, 6, 7, 8, 8, 8

I will have a file like above exported every hour. ReportDateTime column will have same value. How do I display in X axis one value of 2016-10-10 instead of multiple same value?

*chart will monitor files for 30 days so I want to display on X axis one value per day (2016-10-10, 2016-10-11, etc). At this moment Splunk is monitoring files for 5 days and ReportDateTime values are not displayed on X axis (too many).

Thanks

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@valentinv - It would be better if you posted a new question regarding this. Thank you.

0 Karma

valentinv
Explorer

Thanks, somesoni2.

It worked.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...