Is there any way I can manually add another line to a chart, which is just a single value that I can decide?
All I want to do is add a second line to a timechart, set to a specific value.
@samwatson45, are you looking for something like below?
<YourcurrentSearchWithTimechart>
| eval threshold=<yourThresholdValue>
hey try this run anywhere XML for threshold and custom fieldcolor.
<dashboard>
<label>Test</label>
<row>
<panel>
<chart>
<search>
<query>index=_internal
| stats count by sourcetype
| eval threshold=20000</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="charting.fieldColors">
{"count": 0xFF0000, "threshold": 0xFF9900}
</option>
</chart>
</panel>
</row>
</dashboard>
For more info, have a look at this Specify custom colors for fields in charts
You can use | eval threshold=<int>
to create a flat line on the chart and to give custom color to this or any field. you can make use of <option name="charting.fieldColors">{"count": 0xFF0000, "threshold": 0xFF9900}</option>
where count
and threshold
are fieldnames with corresponding custom color in hex.
let me know if this helps!
That's very simple, thank you so much!
@samwatson45, are you looking for something like below?
<YourcurrentSearchWithTimechart>
| eval threshold=<yourThresholdValue>
Perfect that works brilliantly! Thank you.
Is there an easy way to custom change the line colour?
I have converted my comment to answer. Please Accept if your issue is resolved!
You can use Simple XML Chart Configuration charting.fieldColors
if you know the field names. Or else you can use charting.seriesColors
if all fields appear in same sequence and are always present. Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference#General_chart_pr...
Thanks a lot, have done!