Dashboards & Visualizations

How to create a chart overlay from the max value of a field?

DEADBEEF
Path Finder

I have a dashboard I use to monitor my HF's.  In this dashboard, I want to add an overlay but the value of the overlay will differ by host so I want to just use eval overlay=max(max_size)  but for some reason, this doesn't seem to work even though the max_size  field is showing up as a number (has the #).  If instead, I just put a numeric value, then the SPL works as expected... what gives?

SPL (hardcoded = working)

 

index=_internal host=hf_1 group=queue name=tcpout_foo
| fillnull value=0 ingest_pipe
| timechart avg(current_size) by ingest_pipe
| eval threshold=512000

 

SPL (variable = NOT working)

 

index=_internal host=hf_1 group=queue name=tcpout_foo
| fillnull value=0 ingest_pipe
| timechart avg(current_size) by ingest_pipe
| eval threshold=max(max_size)

 

Labels (1)
0 Karma

niketn
Legend

@DEADBEEF the reason why hardcoded | eval threshold=512000 works after timechart is that it creates a new threshold field using eval expression.

Based on your query, if you want something similar in effect you would need to place an eval for aggregating max of current_size field before the timechart command (not max_size field as it does not exist as per your SPL). This is because timechart command drops fields not used in aggregation or split.

index=_internal host=hf_1 group=queue name=tcpout_foo
| fillnull value=0 ingest_pipe
| eval threshold=max(current_size)
| timechart max(threshold) as threshold avg(current_size) by ingest_pipe

However as per your question seems like you are trying to calculate average size by each ingestion pipeline and then draw the maximum of average of each pipeline as threshold for corresponding average. Which should use the following SPL:

 

index=_internal host=* group=queue name=*
| fillnull value=0 ingest_pipe 
| timechart avg(current_size) by ingest_pipe useother=f usenull=f limit=0
| eventstats max(*) as max_*

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...