Splunk Search

Is there a way to create a dynamic threshold in timechart

crap30
Engager

I'm trying to create a timechart by combining running jobs data from two source.

The first set of data being the jobs detail captured every 5 minutes.
Second set of data is the threshold (this value could change,although not frequent) captured every 6 hours.

I'm using a left join to join the two dataset, and downfill to fill in the empty field in the "threshold" field.

Everything works fine until the last step, plotting the timechart.
So I'm using command like this

timechart span=5m count(jobid),max(threshold) by status

The problem with the above command is, although the threshold line shows correct value, it generates threshold lines per status
Is there a way to create timechart and not "grouping" certain fields?
What I want to achiveve is to plot a timechart where my number of jobs are group by status, and at the same time, show only one line of "threshold"

Thank you!

*** adding a eval threshold= wont work for me as my threshold value will change over time.

0 Karma
1 Solution

renjith_nair
Legend

@crap30 ,
Try removing it from the result

timechart span=5m count(jobid),max(threshold) as dummy by status
| foreach dummy* [eval threshold='<<FIELD>>']|fields - dummy*
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@crap30 ,
Try removing it from the result

timechart span=5m count(jobid),max(threshold) as dummy by status
| foreach dummy* [eval threshold='<<FIELD>>']|fields - dummy*
---
What goes around comes around. If it helps, hit it with Karma 🙂

crap30
Engager

Thank you! Works like a charm.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...