Hi all, I have a table and I need to highlight the values that are greater than lets say 5 in a line graph. how to select only those specific values into search
| bin _time span=10m
| stats count by _time country
| where count > 5
| xyseries _time country count
This use case is not clear. You have a table and want to make a line graph? Do you want to highlight the anomalous values or select them?
If you know you only want values greater than 5 then a where clause should do the job.
,,, | where myField > 5
If you don't know what the threshold value should be then consider the anomalousvalue command.
... | anomalousvalue action=filter myField
Do tell us more about the use so we can offer better answers.
thanks for the reply, but actually I have this kind of values
and I am using this query
..... | bucket _time span=10m
| chart count by _time,country
and I got the result as shown below
now when I convert it into a graph I wanted to highlight pints that are greater than 5 and also to filterout those points.
| bin _time span=10m
| stats count by _time country
| where count > 5
| xyseries _time country count
thankyou, that worked but first I need to show the graph for all the data then highlight the points greater then 5 and then filter out those points.
this worked well for filtering but I need to highlight them also
A graph is a visualisation of a table of data.
You can have a table with all the data and you can have another table with the filtered data - the visualisation isn't normally going to change from one table to the other.
In the graph with all the data I need to highlight only the points that are greater than 5 is it possible?
This is not possible with standard graphs (as far as I am aware) - having said that, you could overlay a line at 5 so that it is obvious which point are above it
But I am using dashboard studio and I think overlay is not possible in it can you please conform
I don't use Dashboard Studio due to such limitations!
If you are already using a line graph, it could just be another series in the table
| bin _time span=10m
| stats count by _time country
| where count > 5
| xyseries _time country count
| eval threshold=5
thanks
your search
| where value > 5