Dashboards & Visualizations

How to add a calculated values as threshold in a line chart?

anooshac
Communicator

Hi everyone,

 I have a line chart of some tasks and its duration. I am trying to add average of the duration of all tasks as threshold.

 

|stats values(duration) as "Duration(Hr)" by Task|sort Task|stats avg(duration) as threshold

 

I am not getting any results from the query.I have previously added threshold as a fixed value. Is there any different method to add a threshold value which is calculated not fixed.

Labels (2)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Use eventstats

|stats values(duration) as "Duration(Hr)" by Task|sort Task|eventstats avg('Duration(Hr)') as threshold

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use eventstats

|stats values(duration) as "Duration(Hr)" by Task|sort Task|eventstats avg('Duration(Hr)') as threshold
0 Karma

anooshac
Communicator

Thanks!! It is working. Does the aggregate function only work with eventstats?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

No, the aggregate function works for all the stats and chart commands, eventstats adds the field to the events in the pipeline, whereas stats replaces the events in the pipeline

0 Karma

anooshac
Communicator

Thank you so much for the info.

Can you please suggest any resources which will help in increasing the Splunk knowledge..

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Splunk provide various training and certification opportunities

Splunk Training & Certification | Splunk

You can also download and setup trail instances to try things out.

You could look through the answers provided here and other community channels to see how other people have approached various problems.

0 Karma

anooshac
Communicator

Sure..Thank you so much for the info!!

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...