Dashboards & Visualizations

How to create a chart overlay from the max value of a field?

DEADBEEF
Path Finder

I have a dashboard I use to monitor my HF's.  In this dashboard, I want to add an overlay but the value of the overlay will differ by host so I want to just use eval overlay=max(max_size)  but for some reason, this doesn't seem to work even though the max_size  field is showing up as a number (has the #).  If instead, I just put a numeric value, then the SPL works as expected... what gives?

SPL (hardcoded = working)

 

index=_internal host=hf_1 group=queue name=tcpout_foo
| fillnull value=0 ingest_pipe
| timechart avg(current_size) by ingest_pipe
| eval threshold=512000

 

SPL (variable = NOT working)

 

index=_internal host=hf_1 group=queue name=tcpout_foo
| fillnull value=0 ingest_pipe
| timechart avg(current_size) by ingest_pipe
| eval threshold=max(max_size)

 

Labels (1)
0 Karma

niketn
Legend

@DEADBEEF the reason why hardcoded | eval threshold=512000 works after timechart is that it creates a new threshold field using eval expression.

Based on your query, if you want something similar in effect you would need to place an eval for aggregating max of current_size field before the timechart command (not max_size field as it does not exist as per your SPL). This is because timechart command drops fields not used in aggregation or split.

index=_internal host=hf_1 group=queue name=tcpout_foo
| fillnull value=0 ingest_pipe
| eval threshold=max(current_size)
| timechart max(threshold) as threshold avg(current_size) by ingest_pipe

However as per your question seems like you are trying to calculate average size by each ingestion pipeline and then draw the maximum of average of each pipeline as threshold for corresponding average. Which should use the following SPL:

 

index=_internal host=* group=queue name=*
| fillnull value=0 ingest_pipe 
| timechart avg(current_size) by ingest_pipe useother=f usenull=f limit=0
| eventstats max(*) as max_*

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...