- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to pass aggregate function from drop down to time series chart
kirrusk
Communicator
10-23-2021
06:27 AM
Hi,
I'm trying to pass the aggregate function from the dropdown menu in the Splunk dashboard to the time-series chart.
for example from dropdown, I want to pass
actual,
Avg(),
max()
to below search
index = _internal sourcetype = * | search field=* Exhost=* | chart max(value) by _time,Exhost
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
PickleRick

SplunkTrust
10-23-2021
09:15 AM
Just create a dropdown with a token name, let's say, "argfunc". Then in your search do
index = _internal sourcetype = * | search field=* Exhost=* | chart $argfunc$(value) by _time,Exhost
As simple as that.
