Splunk Search

How to create an area chart that displays an average of data over time, using timechart and stats commands?


I am trying to make an area chart which shows the average size of the parsing queue over time. I would like to add a horizontal bar as a threshold. I noticed that some logs have different values for the max_size_kb, so I thought I could use max to get the value and set my threshold to that, but for some reason, my search is returning zero results. I don't know why it's not working. If I hardcode a number for zzz, it'll work, but doesn't seem to work the way it is written now. The value changes between my hosts, so I don't want to hard code it.

Current SPL

index=_internal host=$hostToken$ group=queue name=parsingqueue 
| stats max(max_size_kb) AS zzz
| timechart avg(current_size_kb) by ingest_pipe
| eval threshold = zzz
Labels (4)
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!