Splunk Search

Two overlays, using different time span

New Member

I have the following timechart, that I display in a column chart, where I use the average value as an overlay.

timechart span=1d avg(time), count

However, if possible, I'd like a second overlay that should show a flat line with the average time over the entire search period, not just the daily span for the timechart.

Labels (2)
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.