Splunk Search

Drop down menu loses trend line

DTERM
Contributor

I have the following code that works fine in a view and chart...

<searchTemplate>index=MyApp Alert_Type&lt;2 earliest=-2w GroupName!="No Support Group"| dedup Serial | timechart count as yvalue | `lineartrend(_time,yvalue)` | timechart sum(yvalue) sum(newY)</searchTemplate>

When I add a dropdown option for the groupname, the chart loses the linear trend. Here is the code that does not work..

<searchTemplate>index=MyApp Alert_Type&lt;2 earliest=-2w GroupName=$GroupName$ | dedup Serial | timechart count as yvalue | `lineartrend(_time,yvalue)` | timechart sum(AlertCounts) sum(newY)</searchTemplate>

How do I keep the trend line with the drop down menu? Thanks in advance.

Tags (1)
0 Karma

HiroshiSatoh
Champion

This right?
・・・・・ | timechart sum(AlertCounts) sum(newY)
sum(AlertCounts) -> sum(yvalue) ?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...