Getting Data In

Mark values in Diagram

Linze99
Explorer

Hi,

so I have a Bargraph with many values. The enduser who has to use that bargraph needs to see if the values are over or under certain values at some point. Thats why I want to draw a line at both the max allowed value and the min needed value. I attached a picture of how I want it to look. Is it possible to achieve something like this?

Labels (1)
0 Karma
1 Solution

skrajkumar_splu
Splunk Employee
Splunk Employee

I believe you are trying to add threshold values to your Column chart. If so please try in adding the threshold limits via eval . And add them as chart overlays as shown below

index=_internal sourcetype=splunk* | stats count by sourcetype | eval lower_threshold = 400 | eval higher_threshold = 6000

 

skrajkumar_splu_0-1635605968695.png

 

skrajkumar_splu_1-1635606022910.png

 

 

View solution in original post

skrajkumar_splu
Splunk Employee
Splunk Employee

I believe you are trying to add threshold values to your Column chart. If so please try in adding the threshold limits via eval . And add them as chart overlays as shown below

index=_internal sourcetype=splunk* | stats count by sourcetype | eval lower_threshold = 400 | eval higher_threshold = 6000

 

skrajkumar_splu_0-1635605968695.png

 

skrajkumar_splu_1-1635606022910.png

 

 

Linze99
Explorer

Hi again,

I now managed to show these thresholds in my chart. There is one Problem: I need the threshold on the X Axis not on the Y Axis(as I showed in the picture in my initial post above). Is there a way to do that?

0 Karma

Linze99
Explorer

Thanks for the reply,

this seems to be exactly what I need, but I am not able to achieve the same result as you with my chart. I want to show just the value of one particular field and how often the different values exist. I do this via the pivot Tool. I cant find the Overlay option. DoI have to use the eval command?

0 Karma
Get Updates on the Splunk Community!

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...