Splunk Search

Constant Horizontal Line On Line Chart

Path Finder

I'm putting together a line chart measuring application response time in milliseconds. What I would like to is put a horizontal line on the chart which is a constant value. This represents an SLA. This will allow us to determine whether the SLA has been exceeded/breached. Any thoughts on how to do this

Tags (1)

New Member

I managed to fill the gaps with the make continuous and fullnull commands

... | eval SLA=5 | timechart avg(responsetime) as responsetime, first(SLA) as SLA | table _time, responsetime, sla | makecontinuous _time span=10m | fillnull value=5 SLA
,I managed to fill the gaps with the make continuous and fullnull commands

| eval SLA=5 | timechart avg(responsetime) as responsetime, first(SLA) as SLA
| table _time, responsetime, sla | makecontinuous _time span=10m | fillnull value=5 SLA

0 Karma

Splunk Employee
Splunk Employee

You can simply add a series to the chart:

... | eval SLA=5 | timechart avg(responsetime) as responsetime, first(SLA) as SLA

Path Finder

I know this is a really old post- but couldn't find a similar question.

The "| eval SLA=5 " works fine, but how could you do it if you wanted the value "5" to come from a search? eg:

splunkserver=splunkunix index=internal sourcetype="splunkd" component="LicenseUsage" pool="EFX Prod" NOT type=RolloverSummary | eval Gb=b/1024/1024/1024| timechart span=1h sum(Gb) as total | streamstats sum(total) AS cumulativetotal | predict cumulativetotal | appendcols [| rest /services/licenser/pools | where like(title,"%EFX Prod%") | eval quota=quota/1024/1024/1024| fields quota] | eval quota2=quota| eval quota=150

Here I'm trying to add a horizontal line for the quota, ie the result from:
| rest /services/licenser/pools | where like(title,"%EFX Prod%") | eval quota=quota/1024/1024/1024| fields quota

"quota" works fine
"quota2" just displays as a single point

0 Karma

Path Finder

figured it out:

splunkserver=splunkunix index=internal sourcetype="splunkd" component="LicenseUsage" pool="EFX Prod" NOT type=RolloverSummary | eval Gb=b/1024/1024/1024| timechart span=1h sum(Gb) as total | streamstats sum(total) AS cumulativetotal | predict cumulativetotal | eval quota = [| rest /services/licenser/pools | where like(title,"%EFX Prod%") | eval quota=quota/1024/1024/1024| fields quota | head 1 | return $quota]

0 Karma

Communicator

Having the eval command afterwards allows the search to be accelerated.

0 Karma

Splunk Employee
Splunk Employee

I'd usually add the series after the fact:

... | timechart avg(responsetime) as responsetime | eval SLA = 5