- Splunk Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Re: line of threshold in timechart graph
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My request is simple
sourcetype="mysourcetype" login OK | timechart count by host
I want to visualize the threshold value, so i add a field thresold with value of 350
My new request is :
sourcetype="mysourcetype" login OK | eval threshold=350 | timechart count max(threshold) by host
but I have 10 host and splunk is drawing 10 superposed lines of threshold or i want to show only one line at 350
how can i do this ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
in Overlay section, it prupose me 10 max(threshold), one per host.
I choose one but it didn't change the graph
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
in Overlay section, it prupose me 10 max(threshold), one per host.
I choose one but it didn't change the graph
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try changing the query as suggested below by @whrg
sourcetype="mysourcetype" login OK | timechart count by host | eval threshold=350
Then go to Format => Chart Overlay => Overlay and choose the threshold field. This will display a line in your chart.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You have to format the visualization...
Go to Format => Chart Overlay => Overlay and choose your threshold field as overlay parameter.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Also, I would move the eval expression to the end of the search query. Something like this:
sourcetype="mysourcetype" login OK | timechart count by host | eval threshold=350
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is the good request.
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could you please accept the answer as correct if it helped you?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You are totally right here 🙂 Makes even more sense!
Welcome to the Splunk Community!
Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM
Adoption of RUM and APM at Splunk
