Hi @dixa0123, SplunkWeb uses hidden field attributes to identify aggregations for trellis mode in Simple XML. (I haven't tried this in Dashboard Studio.) Here's a sample search that summarizes data, calculates a global mean, reformats the results, and then uses the global mean as an overlay in trellis mode: index=_internal
| timechart limit=10 span=1m usenull=f useother=f count as x by component
| untable _time component x
``` calculate a global mean ```
| eventstats avg(x) as tmp
``` append temporary events to hold the mean as a series ```
| appendpipe
[| stats values(tmp) as x by _time
| eval component="tmp" ]
``` reformat the results for trellis ```
| xyseries _time component x
``` disassociate the tmp field from aggregations to use as an overlay ```
| eval baseline=tmp
``` remove the tmp field ```
| fields - tmp
... View more
