I have the following search:
index=main_index sourcetype=Perfmon:InboundPSTNCalls | timechart span=5min avg(Value) as "Inbound PSTN Calls" by host | addtotals | eval threshold=50
This result's exactly what I want, but now I have the value of the threshold saved in a field called threshold.
How can I define the variable as the value of the field?
Thanks for the responses! 🙂
do you mean something like this?
index=main_index sourcetype=Perfmon:InboundPSTNCalls | eval threshold=50 | timechart span=5min avg(Value) as "Inbound PSTN Calls" avg(threshold) as threshold by host
do you mean something like this?
index=main_index sourcetype=Perfmon:InboundPSTNCalls | eval threshold=50 | timechart span=5min avg(Value) as "Inbound PSTN Calls" avg(threshold) as threshold by host
Could you provide more about "defining the variable as the value of the field"? What is the expected output?