How can I display only 1 value in a timechart that uses a by

[Splunked_Kid]

Hello
how can I display only 1 value of these 3 "maxCapacitMachine" results (which are the same in all 3 cases) in a BY timechart?

[Splunked_Kid]

ok but max is a value that I get from the index and not a value that I attribute.  My problem is that the value I get from the index is the same for all 3 LPARs, I only want to display it 1 time.

[Splunked_Kid]

[MuS · Accepted solution]

Please add this 

 | eval foo=0 | foreach max* [ eval foo='<<FIELD>>'] | fields - max* | rename foo AS max

at the end of your SPL 🙂 

[Splunked_Kid]

It works! Thank you very much MuS!

[MuS]

Hi there,

if your max value is static, you could do something like this:

index=_internal sourcetype=* | timechart span=1h count by sourcetype | eval max=10000000

and this will produce 1 max line on the graph like this:

Hope this helps ...

cheers, MuS