line of threshold in timechart graph

[faribole]

My request is simple

sourcetype="mysourcetype" login OK | timechart count by host

I want to visualize the threshold value, so i add a field thresold with value of 350

My new request is :

sourcetype="mysourcetype" login OK | eval threshold=350 | timechart count max(threshold) by host

but I have 10 host and splunk is drawing 10 superposed lines of threshold or i want to show only one line at 350

how can i do this ?

[faribole · Accepted solution]

in Overlay section, it prupose me 10 max(threshold), one per host.
I choose one but it didn't change the graph

[DMohn]

Try changing the query as suggested below by @whrg

sourcetype="mysourcetype" login OK | timechart count by host | eval threshold=350

Then go to Format => Chart Overlay => Overlay and choose the threshold field. This will display a line in your chart.

[DMohn]

You have to format the visualization...

Go to Format => Chart Overlay => Overlay and choose your threshold field as overlay parameter.

[whrg]

Also, I would move the eval expression to the end of the search query. Something like this:

sourcetype="mysourcetype" login OK | timechart count by host | eval threshold=350

[faribole]

This is the good request.
Thanks

[DMohn]

Could you please accept the answer as correct if it helped you?

[DMohn]

You are totally right here 🙂 Makes even more sense!