Splunk Search

Constant Horizontal Line On Line Chart

sajbutler
Path Finder

I'm putting together a line chart measuring application response time in milliseconds. What I would like to is put a horizontal line on the chart which is a constant value. This represents an SLA. This will allow us to determine whether the SLA has been exceeded/breached. Any thoughts on how to do this

Tags (1)

splunkmaesi
New Member

I managed to fill the gaps with the make continuous and fullnull commands

... | eval SLA=5 | timechart avg(responsetime) as responsetime, first(SLA) as SLA | table _time, responsetime, sla | makecontinuous _time span=10m | fillnull value=5 SLA
,I managed to fill the gaps with the make continuous and fullnull commands

| eval SLA=5 | timechart avg(responsetime) as responsetime, first(SLA) as SLA
| table _time, responsetime, sla | makecontinuous _time span=10m | fillnull value=5 SLA

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You can simply add a series to the chart:

... | eval SLA=5 | timechart avg(responsetime) as responsetime, first(SLA) as SLA

kyleharrison
Path Finder

I know this is a really old post- but couldn't find a similar question.

The "| eval SLA=5 " works fine, but how could you do it if you wanted the value "5" to come from a search? eg:

splunk_server=splunk*unix* index=_internal sourcetype="splunkd" component="LicenseUsage" pool="EFX Prod" NOT type=RolloverSummary | eval Gb=b/1024/1024/1024| timechart span=1h sum(Gb) as total | streamstats sum(total) AS cumulative_total | predict cumulative_total | appendcols [| rest /services/licenser/pools | where like(title,"%EFX Prod%") | eval quota=quota/1024/1024/1024| fields quota] | eval quota2=quota| eval quota=150

Here I'm trying to add a horizontal line for the quota, ie the result from:
| rest /services/licenser/pools | where like(title,"%EFX Prod%") | eval quota=quota/1024/1024/1024| fields quota

"quota" works fine
"quota2" just displays as a single point

0 Karma

kyleharrison
Path Finder

figured it out:

splunk_server=splunk*unix* index=_internal sourcetype="splunkd" component="LicenseUsage" pool="EFX Prod" NOT type=RolloverSummary | eval Gb=b/1024/1024/1024| timechart span=1h sum(Gb) as total | streamstats sum(total) AS cumulative_total | predict cumulative_total | eval quota = [| rest /services/licenser/pools | where like(title,"%EFX Prod%") | eval quota=quota/1024/1024/1024| fields quota | head 1 | return $quota]

0 Karma

AlexMcDuffMille
Communicator

Having the eval command afterwards allows the search to be accelerated.

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

I'd usually add the series after the fact:

... | timechart avg(responsetime) as responsetime | eval SLA = 5

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...