Splunk Search

get the values in each line

secure
Path Finder

Hi i have a below query where I'm calculating the total prod server count in first dataset and in second dataset I'm plottting a timechart for the server count. what i want to display is a line chart with total prod server showing as threshold and line and the below line chart as server count

index=data sourcetype="server"
| rex field=_raw "server=\"(?<EVENT_CODE>[^\"]*)"
| search [ | inputlookup prodata_eventcode.csv | fields EVENT_Code ]
| stats dc(host_name) as server_prod_count
|rename
| append
[
| search index=appdata source=appdata_value
| rex field=value "\|(?<Item>[^\|]+)?\|(?<EVENT_CODE>[^\|]+)|(?<PROD_Count>[^\|]+)?"
| dedup DATE,EVENT_CODE
| timechart span=1d sum(PROD_Count) as SERVER_COUNT]
| table _time,local_PROD_COUNT,snow_prod_count
| rename DYNA_PROD_COUNT as SERVER_COUNT,snow_prod_count as Threshold

Question is how can  i get the threshold value in all the rows so that i can plot threshold vs server count in the line graph 

Below is the snapshot 

secure_0-1734618949170.png

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

From where you are, you could simply do something like this

| filldown Threshold

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

From where you are, you could simply do something like this

| filldown Threshold
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...