Splunk Search

Timechart add value that doesn't appear in log

gnoellbn
Explorer

Hello,

I'm trying to add a value to my timechart which doesn't appear in my log.

That search gives me my graph but I would like to add a field "MaxQuota" equals to 5

index=_internal source="/opt/splunk/var/log/splunk/license_audit.log" | timechart values(quotaExceededCount) |

Does anyone now how to do this ?

Thanks

Tags (1)
0 Karma
1 Solution

gfuente
Motivator

Hello

Just try this:

index=_internal source="/opt/splunk/var/log/splunk/license_audit.log" | eval MaxQuota="5" | timechart values(quotaExceededCount), last(MaxQuota)

This will give you a horizontal line in the chart as well as your previous data.

regards

View solution in original post

gfuente
Motivator

Hello

Just try this:

index=_internal source="/opt/splunk/var/log/splunk/license_audit.log" | eval MaxQuota="5" | timechart values(quotaExceededCount), last(MaxQuota)

This will give you a horizontal line in the chart as well as your previous data.

regards

gfuente
Motivator

Easy one 🙂

0 Karma

gnoellbn
Explorer

that's simple enough, I though "eval" would only take actual fields
thanks a lot 🙂

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...