Dashboards & Visualizations

line of threshold in timechart graph

faribole
Path Finder

My request is simple

sourcetype="mysourcetype" login OK | timechart count by host

I want to visualize the threshold value, so i add a field thresold with value of 350

My new request is :

sourcetype="mysourcetype" login OK | eval threshold=350 | timechart count max(threshold) by host

but I have 10 host and splunk is drawing 10 superposed lines of threshold or i want to show only one line at 350

how can i do this ?

Tags (1)
0 Karma
1 Solution

faribole
Path Finder

in Overlay section, it prupose me 10 max(threshold), one per host.
I choose one but it didn't change the graph

View solution in original post

0 Karma

faribole
Path Finder

in Overlay section, it prupose me 10 max(threshold), one per host.
I choose one but it didn't change the graph

0 Karma

DMohn
Motivator

Try changing the query as suggested below by @whrg

sourcetype="mysourcetype" login OK | timechart count by host | eval threshold=350

Then go to Format => Chart Overlay => Overlay and choose the threshold field. This will display a line in your chart.

0 Karma

DMohn
Motivator

You have to format the visualization...

Go to Format => Chart Overlay => Overlay and choose your threshold field as overlay parameter.

whrg
Motivator

Also, I would move the eval expression to the end of the search query. Something like this:

sourcetype="mysourcetype" login OK | timechart count by host | eval threshold=350

faribole
Path Finder

This is the good request.
Thanks

0 Karma

DMohn
Motivator

Could you please accept the answer as correct if it helped you?

0 Karma

DMohn
Motivator

You are totally right here 🙂 Makes even more sense!

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...