SLA Line on Chart

Question

I am using this search to get license use over 30 days

 index="summary_indexers" | timechart partial=f span=1d sum(kb) as KB | eval gb=round(KB/1048576,1) | convert timeformat="%A - %m/%d" ctime(_time) AS DATE | table DATE gb

This gives ma b bar chart with one bar per day.

I would like to put a RED SLA line at the license limit so that the managers can clearly see where the License SLA will be violated and how close we are to that line.

Accepted Answer

0

Except for the RED part (which is configurable as part of the viewstate / dashboard config), this search adds in your SLA line:

index="summary_indexers" 
| eval sla=20 
| timechart partial=f span=1d sum(kb) as KB,max(sla) as SLA 
| eval gb=round(KB/1048576,1) 
| convert timeformat="%A - %m/%d" ctime(_time) AS DATE 
| table DATE gb SLA

link

answered 27 Dec '11, 12:35

dwaddle ♦
15.2k●2●9●23
accept rate: 33%

Thanks that did it

(27 Dec '11, 13:20) hartfoml

SLA Line on Chart

Follow this question

Splunk Resources

Related questions