Splunk Search

timechart with SLA value

hartfoml
Motivator

I would like to create a timechart with an SLA value.

I have tried this search sourcetype=foo | eval sla=50 | timechart span=15m count | table count sla

this did not work reliably.

Can anyone suggest a better way

0 Karma
1 Solution

jonuwz
Influencer

This is probably what you need :

search sourcetype=foo | timechart span=15m count | eval sla=50

View solution in original post

jonuwz
Influencer

This is probably what you need :

search sourcetype=foo | timechart span=15m count | eval sla=50

MuS
Legend

found one way to be able to drill down with sla line, use the eval before the timechart like this:

… | eval b=50 | timechart values(b) as base count by foo

MuS
Legend

Hi, using this eval after timechart works perfect. But if you create a report view out of it, you are no longer able to drill down -> PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'eval' command

How can this be avoid?

0 Karma

hartfoml
Motivator

Thanks Jonuwx

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...