I have a search like this:
index=wilee sourcetype=foo OR sourcetype=foo2
| transaction fields="acme,coyote" maxevents=2 keeporphans=f endswith="beepbeep" startswith="genius"
| rangemap field=duration "0-1m"=0-60 "1-2m"=60.0001-120 "2-5m"=120.00001-300 "5-10m"=300.00001-600 ">10m"=600.00001-9999999
| timechart span=1h count by range
This makes for a nice stacked column showing me distributions of durations by hour. I'd like to overlay a line on a secondary Y axis to display median durations by hour, eg
index=wilee sourcetype=foo OR sourcetype=foo2 | transaction fields="acme,coyote" maxevents=2 keeporphans=f endswith="beepbeep" startswith="genius" | timechart span=1h perc50(duration)
...but I'm struggling. Splunk's examples use a large dataset for axis y1, and then a subset of that for y2.
Take a look at stream stats. This will let you add the mean to all events so it will be aviable as a field in your event and easily add it to your final timechart.
http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/streamstats#Examples