How to display the average of the week as a straight line overlay in a timechart?

[hofer]

I have a timechart with the Duration average (ca. 16ms) per second. timespan is 4s, the timechart itself is over 1 hour.

Now I'd like to have a reference value. A straight, horizontal line with the value of the average over the past week would be perfect. How can I overlay this value?

The "next level" of this would be to save that value and only re-aggregate it every day at midnight so it doesn't use too many resources and affect performance.

The search until now looks like this:

index=msh host="prod*" sourcetype=Message | timechart span=4s avg(Message_DURATION_SMSC) AS ms

[stephanefotso · Accepted solution]

Hi! for the command to use, i think you can use this:

index=msh host="prod*" sourcetype=Message | timechart span=4s avg(Message_DURATION_SMSC) AS ms|join [search index=msh host="prod*" sourcetype=Message | timechart span=7d avg(Message_DURATION_SMSC) AS mweek]

here is an example you can use as a template, for your chart overlay. it is using the _internal index. Just copy and test the code.

<dashboard>
  <label>Chart Overlay</label>
  <description>display the average of the week as a straight line overlay in a timechart</description>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal sourcetype=splunkd |timechart span=4s avg(active_hist_searches) AS AverageSearch_per_second|join [search index=_internal sourcetype=splunkd |timechart span=7d avg(active_hist_searches) AS AverageSearch_per_week]</query>
          <earliest>@d</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">true</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.chart.overlayFields">AverageSearch_per_week</option>
      </chart>
    </panel>
  </row>
</dashboard>

[tachifelix]

please share more information about your topic