Hi! I've got a very simple timechart query that pulls up number of user sessions per day. What I want to do is to add a label or a line that marks when a major event occurred so I can see how the user sessions have changed after it. How do I go about adding these labels?
Query being used:
| timechart span=1day@day dc(session_id) values(session_id)
@sharonmok, if you are on Splunk 7+ you can take advantage of Event Annotations
Unfortunately, I'm on 6.6.4
One simple way to do this is just to add another field to cause a "blip" at the date/time that you want. This could be done either by ...
| timechart span=1day@day dc(session_id) values(session_id)
| eval blip=case(_time=the time of the event, 1000)
... or by ...
| append [|makeresults | eval _time=the time of the event, blip=1000 | table _time blip]
| timechart span=1day@day dc(session_id) values(session_id) max(blip)
Thanks for your reply. I tried both of these and unfortunately, a blip doesn't get created. It's just the same chart.