How to chart the number of occurrences including its respective threshold for each host and each eventtype?

[zapping575]

Hi everybody,

I have the following problem and cannot seem to be able to wrap my head around it:

1. I have a bunch of eventtypes (close to 1000).
2. Some of those eventtypes have certain thresholds which are greater than zero. I look the values up from a csv
3. For a single host, I'd like to
   
   1. Chart the number of occurrances for an eventtype IF
      1. That number of occurrances is higher than the aforementioned threshold
      2. The chart shall also contain a static line depicting the threshold value

Here is what I have so far. I believe I am always getting lost when using an aggregate function such as count() because added something to the result using eval just wont work.

index="my_index" eventtype=* host="$HOST_FROM_DROPDOWN$"  
| lookup my-events eventtype 
| eventstats count by eventtype 
| where alert_threshold > 0 AND count > alert_threshold
| stats count by eventtype 
| eval Threshold = alert_threshold

 What I do understand is that I have to add the "Threshold" variable in the overlay Options of the chart.

Any help is much appreciated. Thank you

[ITWhisperer · Accepted solution]

| stats count values(alert_threshold) as alert_threshold by eventtype 

[zapping575]

Thank you very much. I got it working as expected like this:

index="my_index" eventtype=* host="dropdown_value..."  
| lookup my_lookup eventtype 
| stats count values(alert_threshold) as alert_threshold by eventtype 
| where alert_threshold > 0 AND count > alert_threshold
| sort count desc

Now the only thing left is that the threshold value is drawn as a dot in the chart. I'd like it to be a line going across the entire bar. Is that possible?

[ITWhisperer]

You will get a dot if there is only 1 point on the line e.g. only one event type breaches the threshold

[zapping575]

Acknowledged. thanks