timechart with SLA value

[hartfoml]

I would like to create a timechart with an SLA value.

I have tried this search sourcetype=foo | eval sla=50 | timechart span=15m count | table count sla

this did not work reliably.

Can anyone suggest a better way

[jonuwz · Accepted solution]

This is probably what you need :

search sourcetype=foo | timechart span=15m count | eval sla=50

[MuS]

found one way to be able to drill down with sla line, use the eval before the timechart like this:

… | eval b=50 | timechart values(b) as base count by foo

[MuS]

Hi, using this eval after timechart works perfect. But if you create a report view out of it, you are no longer able to drill down -> PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'eval' command

How can this be avoid?

[hartfoml]

Thanks Jonuwx