How to modify my search to display thresholds from column values in a line chart?

[valentinv]

Hi

I have the following search:

index=myIndex Type="myType" | table Column1, Column2

Also I want to display two thresholds on line chart and values are in different columns. These thresholds can have different values.

So, if I write like this:

index=myIndex Type="myType" | table Column1, Column2 | eval Threshold1=25 | eval ThreShold2=75

...thresholds appear on line chart with different colors (that's exactly what I need).

But how can I write the search to look for thresholds in Thresholds1 and Thresholds2 columns and also to be visible on line chart?

Thanks!

[somesoni2 · Accepted solution]

I think you're already there. Just run this search, Go to visualization section, select chart type as column. Go to Visualization Format option -> Chart overlay and add both Threshold1 and Threshold2 field as overlay field. This way Column1 and Column2 will be displayed as columns and Threshold1 and Threshold2 would come as horizontal line chart.

[valentinv]

I don't know if is ok to post here or should open another topic but based on issue above...

I need to monitor a csv file in Splunk with following structure:

ReportDateTime, Value1, Value2, Value3, Threshold1, Threshold2
2016-10-10, 0, 1, 2, 4, 4
2016-10-10, 3, 4, 5, 4, 4

2016-10-10, 6, 7, 8, 8, 8

I will have a file like above exported every hour. ReportDateTime column will have same value. How do I display in X axis one value of 2016-10-10 instead of multiple same value?

*chart will monitor files for 30 days so I want to display on X axis one value per day (2016-10-10, 2016-10-11, etc). At this moment Splunk is monitoring files for 5 days and ReportDateTime values are not displayed on X axis (too many).

Thanks

[aaraneta_splunk]

@valentinv - It would be better if you posted a new question regarding this. Thank you.

[valentinv]

Thanks, somesoni2.

It worked.