Splunk Search

timechart with SLA value

hartfoml
Motivator

I would like to create a timechart with an SLA value.

I have tried this search sourcetype=foo | eval sla=50 | timechart span=15m count | table count sla

this did not work reliably.

Can anyone suggest a better way

0 Karma
1 Solution

jonuwz
Influencer

This is probably what you need :

search sourcetype=foo | timechart span=15m count | eval sla=50

View solution in original post

jonuwz
Influencer

This is probably what you need :

search sourcetype=foo | timechart span=15m count | eval sla=50

MuS
Legend

found one way to be able to drill down with sla line, use the eval before the timechart like this:

… | eval b=50 | timechart values(b) as base count by foo

MuS
Legend

Hi, using this eval after timechart works perfect. But if you create a report view out of it, you are no longer able to drill down -> PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'eval' command

How can this be avoid?

0 Karma

hartfoml
Motivator

Thanks Jonuwx

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...