I'm trying to set up a dashboard panel to automatically alert me every time the number of critical or high threat hits goes over a pre-determined baseline. Right now I have that manually calculated, but I can go through and tweak that later. So, what I've got so far:
sourcetype="pan_threat" (severity="high" OR "critical") | timechart span=1h count by date | eval Baseline=1240 | stats first(Baseline) as Baseline
I expected this to chart the normal graph of count by date that I've been using, then append a line at the value of Baseline for each day. Instead, I get this.
Baseline
1 1240
Any thoughts on why it's not working?
Your last command is a stats command so you get that view.
Updated:
<...> | timechart count, first(BaseLine) as Baseline by date | eval BaseLine=1240
This works for me, i just moved the split by date after the first(BaseLine) as Baseline. If you create a line chart you should then see the two lines you are looking for.
<...> | timechart count, first(BaseLine) as Baseline by date | eval BaseLine=1240
That is a lot better. I just completely got rid of the "By Date". However, now the baseline appears broken up. Wish I could post links, I'd show you an image of what I see.
Oh yeah sorry, the by date part is messing that up. I think you can move the split 'by date' to the end. I'm on my phone right now but will check this for you later.
And then I get the following error.
Error in 'timechart' command: The argument 'first(baseline)' is invalid.