Getting Data In

Mark values in Diagram

Linze99
Explorer

Hi,

so I have a Bargraph with many values. The enduser who has to use that bargraph needs to see if the values are over or under certain values at some point. Thats why I want to draw a line at both the max allowed value and the min needed value. I attached a picture of how I want it to look. Is it possible to achieve something like this?

0 Karma
1 Solution

skrajkumar_splu
Splunk Employee
Splunk Employee

I believe you are trying to add threshold values to your Column chart. If so please try in adding the threshold limits via eval . And add them as chart overlays as shown below

index=_internal sourcetype=splunk* | stats count by sourcetype | eval lower_threshold = 400 | eval higher_threshold = 6000

 

skrajkumar_splu_0-1635605968695.pngskrajkumar_splu_0-1635605968695.png

 

skrajkumar_splu_1-1635606022910.pngskrajkumar_splu_1-1635606022910.png

 

 

View solution in original post

skrajkumar_splu
Splunk Employee
Splunk Employee

I believe you are trying to add threshold values to your Column chart. If so please try in adding the threshold limits via eval . And add them as chart overlays as shown below

index=_internal sourcetype=splunk* | stats count by sourcetype | eval lower_threshold = 400 | eval higher_threshold = 6000

 

skrajkumar_splu_0-1635605968695.pngskrajkumar_splu_0-1635605968695.png

 

skrajkumar_splu_1-1635606022910.pngskrajkumar_splu_1-1635606022910.png

 

 

Linze99
Explorer

Hi again,

I now managed to show these thresholds in my chart. There is one Problem: I need the threshold on the X Axis not on the Y Axis(as I showed in the picture in my initial post above). Is there a way to do that?

0 Karma

Linze99
Explorer

Thanks for the reply,

this seems to be exactly what I need, but I am not able to achieve the same result as you with my chart. I want to show just the value of one particular field and how often the different values exist. I do this via the pivot Tool. I cant find the Overlay option. DoI have to use the eval command?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next.  Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas     Do you ever feel ...