How to create a chart overlay from the max value of a field?

[DEADBEEF]

I have a dashboard I use to monitor my HF's.  In this dashboard, I want to add an overlay but the value of the overlay will differ by host so I want to just use eval overlay=max(max_size)  but for some reason, this doesn't seem to work even though the max_size  field is showing up as a number (has the #).  If instead, I just put a numeric value, then the SPL works as expected... what gives?

SPL (hardcoded = working)

index=_internal host=hf_1 group=queue name=tcpout_foo
| fillnull value=0 ingest_pipe
| timechart avg(current_size) by ingest_pipe
| eval threshold=512000

SPL (variable = NOT working)

index=_internal host=hf_1 group=queue name=tcpout_foo
| fillnull value=0 ingest_pipe
| timechart avg(current_size) by ingest_pipe
| eval threshold=max(max_size)

[niketn]

@DEADBEEF the reason why hardcoded | eval threshold=512000 works after timechart is that it creates a new threshold field using eval expression.

Based on your query, if you want something similar in effect you would need to place an eval for aggregating max of current_size field before the timechart command (not max_size field as it does not exist as per your SPL). This is because timechart command drops fields not used in aggregation or split.

index=_internal host=hf_1 group=queue name=tcpout_foo
| fillnull value=0 ingest_pipe
| eval threshold=max(current_size)
| timechart max(threshold) as threshold avg(current_size) by ingest_pipe

However as per your question seems like you are trying to calculate average size by each ingestion pipeline and then draw the maximum of average of each pipeline as threshold for corresponding average. Which should use the following SPL:

index=_internal host=* group=queue name=*
| fillnull value=0 ingest_pipe 
| timechart avg(current_size) by ingest_pipe useother=f usenull=f limit=0
| eventstats max(*) as max_*