Constant Horizontal Line On Line Chart

[sajbutler]

I'm putting together a line chart measuring application response time in milliseconds. What I would like to is put a horizontal line on the chart which is a constant value. This represents an SLA. This will allow us to determine whether the SLA has been exceeded/breached. Any thoughts on how to do this

[splunkmaesi]

I managed to fill the gaps with the make continuous and fullnull commands

... | eval SLA=5 | timechart avg(responsetime) as responsetime, first(SLA) as SLA | table _time, responsetime, sla | makecontinuous _time span=10m | fillnull value=5 SLA
,I managed to fill the gaps with the make continuous and fullnull commands

| eval SLA=5 | timechart avg(responsetime) as responsetime, first(SLA) as SLA
| table _time, responsetime, sla | makecontinuous _time span=10m | fillnull value=5 SLA

[gkanapathy]

You can simply add a series to the chart:

... | eval SLA=5 | timechart avg(responsetime) as responsetime, first(SLA) as SLA

[kyleharrison]

I know this is a really old post- but couldn't find a similar question.

The "| eval SLA=5 " works fine, but how could you do it if you wanted the value "5" to come from a search? eg:

splunk_server=splunk*unix* index=_internal sourcetype="splunkd" component="LicenseUsage" pool="EFX Prod" NOT type=RolloverSummary | eval Gb=b/1024/1024/1024| timechart span=1h sum(Gb) as total | streamstats sum(total) AS cumulative_total | predict cumulative_total | appendcols [| rest /services/licenser/pools | where like(title,"%EFX Prod%") | eval quota=quota/1024/1024/1024| fields quota] | eval quota2=quota| eval quota=150

Here I'm trying to add a horizontal line for the quota, ie the result from:
| rest /services/licenser/pools | where like(title,"%EFX Prod%") | eval quota=quota/1024/1024/1024| fields quota

"quota" works fine
"quota2" just displays as a single point

[kyleharrison]

figured it out:

splunk_server=splunk*unix* index=_internal sourcetype="splunkd" component="LicenseUsage" pool="EFX Prod" NOT type=RolloverSummary | eval Gb=b/1024/1024/1024| timechart span=1h sum(Gb) as total | streamstats sum(total) AS cumulative_total | predict cumulative_total | eval quota = [| rest /services/licenser/pools | where like(title,"%EFX Prod%") | eval quota=quota/1024/1024/1024| fields quota | head 1 | return $quota]

[AlexMcDuffMille]

Having the eval command afterwards allows the search to be accelerated.

[Stephen_Sorkin]

I'd usually add the series after the fact:

... | timechart avg(responsetime) as responsetime | eval SLA = 5