How do i assign a value to a variable in a splunk search and then use that variable in the search?

[HattrickNZ]

How do i assign a value to a variable in a splunk search and then use that variable in the search?

something like val=1000 | timechart span=d max(val)

I am trying to produce a straight horizontal line that would represend some a limit in a graph.

I am using the predict function at present to help me achive this, but because the val changes sometimes this is when I have to fiddle with the date. So i am looking for a better way.

index=core ... earliest=-2d@d latest=+216d@d |... |timechart span=d max(val) as val_lic | predict val_lic as val_lic future_timespan=216 |

[richgalloway]

Use eval.

... | eval val=1000 | ...

[HattrickNZ]

sorry maybe I was not clear, I want something more like eval val=max(val) and then be able to use this in the predict function

[richgalloway]

The eval command does not have a max function.
To create a horizontal line using the predict command, set the upperXX variable to some fixed value.

... | predict foo future_timespan=216 upper90=upperbound | eval upperbound = 50

or

... | timechart span=d max(val) as val_lic | predict val_lic future_timespan=216 upper90=upperbound | eventstats max(val_lic) as upperbound

[HattrickNZ]

the 1st option gives a broken line and add faded colour between the predict line and it. I guess this is what upperbound and lowerbounds do. For some reason it does not show the upperbound in the legend in the graph but I can see it in the stats tab.

with the 2nd option:
assuming val is constant e.g. 80,000 this gives me a straight line into the future
... | timechart span=d max(val) as val_lic | predict val_lic future_timespan=216

adding the following makes no real difference, except I just get a bit of faded colour
... | timechart span=d max(val) as val_lic | predict val_lic future_timespan=216 upper90=upperbound | eventstats max(val_lic) as upperbound

tks the 1st option is worth noting but the 2nd not add anything extra for me.

My main prlem is getting the horizontal line to cover the dates into the future, which I already addressing, but I was just looking for a better way. For instance if val was an available field, and it was equal to 80, I want to be able to draw that 80 as a horizontal line accross the complete time chart, that is past and future using the predict function.

[richgalloway]

I'm afraid we've pretty much exhausted my knowledge of the predict command.