Splunk Search

Drop down menu loses trend line

DTERM
Contributor

I have the following code that works fine in a view and chart...

<searchTemplate>index=MyApp Alert_Type&lt;2 earliest=-2w GroupName!="No Support Group"| dedup Serial | timechart count as yvalue | `lineartrend(_time,yvalue)` | timechart sum(yvalue) sum(newY)</searchTemplate>

When I add a dropdown option for the groupname, the chart loses the linear trend. Here is the code that does not work..

<searchTemplate>index=MyApp Alert_Type&lt;2 earliest=-2w GroupName=$GroupName$ | dedup Serial | timechart count as yvalue | `lineartrend(_time,yvalue)` | timechart sum(AlertCounts) sum(newY)</searchTemplate>

How do I keep the trend line with the drop down menu? Thanks in advance.

Tags (1)
0 Karma

HiroshiSatoh
Champion

This right?
・・・・・ | timechart sum(AlertCounts) sum(newY)
sum(AlertCounts) -> sum(yvalue) ?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...