Need assistance to create baseline in trellis in splunk dashboard

[dixa0123]

Hello everyone, 

I have created dashboard that shows total log volumes for different sources across 7 days. I am using line chart and trellis. As shown in pic, I want to add median/average value of logs as horizonal red line. Is there a way to achieve it ? Final aim is to be able to observe pattern and median/avg log volumes of certain week that ultimately helps to define baseline of log volume for each source.

below is the SPL I am using,  

| tstats count as log_count where index=myindex AND hostname="colla" AND source=* earliest=--7d@d latest=now by _time, source | timechart span=1d sum(log_count) by source

Any suggestions would be highly appreciated. Thanks

[bowesmana]

Instead of using timechart, you can use stats and bin by _time, e.g.

| tstats count as log_count where index=myindex AND hostname="colla" AND source=* earliest=-7d@d latest=now by _time span=1d, source 
| stats sum(log_count) as sum_log by _time source
| eventstats avg(sum_log) as avg_sum_log by source

and then in your trellis give yourself an independent scale

You seem to need the tstats AND stats to give yourself a trellis by source option.

[dixa0123]

Great, thank you bowesmana. It is working as expected just that can't get to see value on avg. graph. I tried to turn on "show data" option with min/max option which shows value on log graph but not on avg. value graph. Do you have any suggestion to get it done? Appreciate your support. Thanks

[bowesmana]

Mmm, I think the problem is that the min/max applies to the entire dataset rather than per series, because if you don't use trellis, there is only min/max for the entire chart, not per series.

[dixa0123]

That's so true. turning on option " ON" for showing data looks pretty bad on graph. 

[bowesmana]

Note that if you have any days where there are no results, you will not get a datapoint for that day for that source, so it will affect the average. You can probably resolve that if that's an issue.