Splunk Search
Highlighted

## How do I plot a static value over time that is derived from the total count as an overlay on the count per day?

New Member

I'd like to plot in a timechart the count of events over the last 30 days.
In addition to this, I'd like another line which plots a line over the same period from a static value which is derived from the total of counts over the last month / 22.

Whilst I have no problem displaying the count of events over 30 days, I'm unsure as to how to plot a static value (ie. calculate a static value and plot it against all times as a threshold).

The following displays the average based on monthly count.

``````[[search>]] earliest=-30d@d latest=@d
| bucket _time span=1d | stats count as Volume by _time | rename _time As Date | eval Date = strftime(Date, "%a, %b %d")
| eventstats avg(Volume) as "Threshold Volume" | rename Volume as "Daily Volume"
`````` However I actually want the 'Threshold Volume' to instead be derived from Volume / 22.

Tags (5)
1 Solution
Highlighted

## Re: How do I plot a static value over time that is derived from the total count as an overlay on the count per day?

Builder

Hi,

``````... | eval "new Threshhold" = 'Threshold Volume' / 22
``````

This simply calculates the value you want and puts it in a new field.
If you want the total Volume / 22 instead of the avg Volume / 22 as Threshold you need to change the avg in your eventstats to sum.

Greetings

Tom

Highlighted

## Re: How do I plot a static value over time that is derived from the total count as an overlay on the count per day?

New Member

Thanks Tom. Replacing avg() with sum() worked.

Highlighted

## Re: How do I plot a static value over time that is derived from the total count as an overlay on the count per day? SplunkTrust

Try this

``````[[search>]] earliest=-30d@d latest=@d
| bucket _time span=1d | stats count as Volume by _time | rename _time As Date | eval Date = strftime(Date, "%a, %b %d")
| eventstats sum(Volume) as "Threshold Volume" | eval "Threshold Volume"='Threshold Volume' / 22| rename Volume as "Daily Volume"
``````
Highlighted

## Re: How do I plot a static value over time that is derived from the total count as an overlay on the count per day?

New Member

Thanks. That did the trick.