How to chart field1 by field2 and overlay by aggregate

[kabSplunk]

I have two fields
field1 as response time
field 2 as instance name

I want to plot the response time by instance name and overlay the average response time of a single instance name.

Data is like
Instance1 responsetime1
Instance1 responsetime2
:
Instance1 responsetimeN
Instance2 responsetime1
Instance2 responsetime2
:
Instance2 responsetimeN
:
and so on.

So I want chart of responsetime by instance name and an overlay line of avg(responsetime) of only single instance say instance5

Can you please help.

[hunters_splunk · Accepted solution]

HI KabSplunk,

Please try the following:

1. Run the following search:

   sourcetye= | chart count, sum(responsetime) AS total_responsetime by instance | eval avg_responsetime = total_responsetime/count

2. After you get the statistics, go to Visualization.

3. Select Column Chart.

4. Click Format and select ** Chart Overlay**.

5. In the Overlay field, type avg_responsetime.

You should see total_responsetime as columns on the y axis overlayed by the avg_bytes values. Instances are on the x axis.

Hope it helps. Thanks!
Hunter

[hunters_splunk]

The search string was not correctly displayed; should be:

sourcetye= my_sourcetype | chart count, sum(responsetime) AS total_responsetime by instance | eval avg_responsetime = total_responsetime/count

[kabSplunk]

Thanks. I had got it fixed