How do I add time stamp or label onto my timechart to mark a specific time/event?

[sharonmok]

Hi! I've got a very simple timechart query that pulls up number of user sessions per day. What I want to do is to add a label or a line that marks when a major event occurred so I can see how the user sessions have changed after it. How do I go about adding these labels?

Query being used:
| timechart span=1day@day dc(session_id) values(session_id)

[niketn]

@sharonmok, if you are on Splunk 7+ you can take advantage of Event Annotations

[sharonmok]

Unfortunately, I'm on 6.6.4

[DalJeanis]

One simple way to do this is just to add another field to cause a "blip" at the date/time that you want. This could be done either by ...

| timechart span=1day@day dc(session_id) values(session_id)
| eval blip=case(_time=the time of the event, 1000)

... or by ...

| append [|makeresults | eval _time=the time of the event, blip=1000 | table _time blip]
| timechart span=1day@day dc(session_id) values(session_id) max(blip) 

[sharonmok]

Thanks for your reply. I tried both of these and unfortunately, a blip doesn't get created. It's just the same chart.