Splunk Search

Drop down menu loses trend line

DTERM
Contributor

I have the following code that works fine in a view and chart...

<searchTemplate>index=MyApp Alert_Type&lt;2 earliest=-2w GroupName!="No Support Group"| dedup Serial | timechart count as yvalue | `lineartrend(_time,yvalue)` | timechart sum(yvalue) sum(newY)</searchTemplate>

When I add a dropdown option for the groupname, the chart loses the linear trend. Here is the code that does not work..

<searchTemplate>index=MyApp Alert_Type&lt;2 earliest=-2w GroupName=$GroupName$ | dedup Serial | timechart count as yvalue | `lineartrend(_time,yvalue)` | timechart sum(AlertCounts) sum(newY)</searchTemplate>

How do I keep the trend line with the drop down menu? Thanks in advance.

Tags (1)
0 Karma

HiroshiSatoh
Champion

This right?
・・・・・ | timechart sum(AlertCounts) sum(newY)
sum(AlertCounts) -> sum(yvalue) ?

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...