How to add a flat, single value line to a graph?

[samwatson45]

Is there any way I can manually add another line to a chart, which is just a single value that I can decide?

All I want to do is add a second line to a timechart, set to a specific value.

[mayurr98]

hey try this run anywhere XML for threshold and custom fieldcolor.

<dashboard>
  <label>Test</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal 
|  stats count by sourcetype 
|  eval threshold=20000</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.fieldColors">
  {"count": 0xFF0000, "threshold": 0xFF9900}
</option>
      </chart>
    </panel>
  </row>
</dashboard>

For more info, have a look at this Specify custom colors for fields in charts

You can use | eval threshold=<int> to create a flat line on the chart and to give custom color to this or any field. you can make use of <option name="charting.fieldColors">{"count": 0xFF0000, "threshold": 0xFF9900}</option> where count and threshold are fieldnames with corresponding custom color in hex.

let me know if this helps!

[samwatson45]

That's very simple, thank you so much!

[niketn · Accepted solution]

@samwatson45, are you looking for something like below?

<YourcurrentSearchWithTimechart>
| eval threshold=<yourThresholdValue>

[samwatson45]

Perfect that works brilliantly! Thank you.
Is there an easy way to custom change the line colour?

[niketn]

I have converted my comment to answer. Please Accept if your issue is resolved!

You can use Simple XML Chart Configuration charting.fieldColors if you know the field names. Or else you can use charting.seriesColors if all fields appear in same sequence and are always present. Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference#General_chart_pr...

[samwatson45]

Thanks a lot, have done!