Splunk Search

Constant Horizontal Line On Line Chart

sajbutler
Path Finder

I'm putting together a line chart measuring application response time in milliseconds. What I would like to is put a horizontal line on the chart which is a constant value. This represents an SLA. This will allow us to determine whether the SLA has been exceeded/breached. Any thoughts on how to do this

Tags (1)

splunkmaesi
New Member

I managed to fill the gaps with the make continuous and fullnull commands

... | eval SLA=5 | timechart avg(responsetime) as responsetime, first(SLA) as SLA | table _time, responsetime, sla | makecontinuous _time span=10m | fillnull value=5 SLA
,I managed to fill the gaps with the make continuous and fullnull commands

| eval SLA=5 | timechart avg(responsetime) as responsetime, first(SLA) as SLA
| table _time, responsetime, sla | makecontinuous _time span=10m | fillnull value=5 SLA

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You can simply add a series to the chart:

... | eval SLA=5 | timechart avg(responsetime) as responsetime, first(SLA) as SLA

kyleharrison
Path Finder

I know this is a really old post- but couldn't find a similar question.

The "| eval SLA=5 " works fine, but how could you do it if you wanted the value "5" to come from a search? eg:

splunk_server=splunk*unix* index=_internal sourcetype="splunkd" component="LicenseUsage" pool="EFX Prod" NOT type=RolloverSummary | eval Gb=b/1024/1024/1024| timechart span=1h sum(Gb) as total | streamstats sum(total) AS cumulative_total | predict cumulative_total | appendcols [| rest /services/licenser/pools | where like(title,"%EFX Prod%") | eval quota=quota/1024/1024/1024| fields quota] | eval quota2=quota| eval quota=150

Here I'm trying to add a horizontal line for the quota, ie the result from:
| rest /services/licenser/pools | where like(title,"%EFX Prod%") | eval quota=quota/1024/1024/1024| fields quota

"quota" works fine
"quota2" just displays as a single point

0 Karma

kyleharrison
Path Finder

figured it out:

splunk_server=splunk*unix* index=_internal sourcetype="splunkd" component="LicenseUsage" pool="EFX Prod" NOT type=RolloverSummary | eval Gb=b/1024/1024/1024| timechart span=1h sum(Gb) as total | streamstats sum(total) AS cumulative_total | predict cumulative_total | eval quota = [| rest /services/licenser/pools | where like(title,"%EFX Prod%") | eval quota=quota/1024/1024/1024| fields quota | head 1 | return $quota]

0 Karma

AlexMcDuffMille
Communicator

Having the eval command afterwards allows the search to be accelerated.

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

I'd usually add the series after the fact:

... | timechart avg(responsetime) as responsetime | eval SLA = 5

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...