I have a dashboard I use to monitor my HF's. In this dashboard, I want to add an overlay but the value of the overlay will differ by host so I want to just use eval overlay=max(max_size) but for some reason, this doesn't seem to work even though the max_size field is showing up as a number (has the #). If instead, I just put a numeric value, then the SPL works as expected... what gives?
@DEADBEEF the reason why hardcoded | eval threshold=512000 works after timechart is that it creates a new threshold field using eval expression.
Based on your query, if you want something similar in effect you would need to place an eval for aggregating max of current_size field before the timechart command (not max_size field as it does not exist as per your SPL). This is because timechart command drops fields not used in aggregation or split.
index=_internal host=hf_1 group=queue name=tcpout_foo
| fillnull value=0 ingest_pipe
| eval threshold=max(current_size)
| timechart max(threshold) as threshold avg(current_size) by ingest_pipe
However as per your question seems like you are trying to calculate average size by each ingestion pipeline and then draw the maximum of average of each pipeline as threshold for corresponding average. Which should use the following SPL: