I have a timechart with the Duration average (ca. 16ms) per second. timespan is 4s, the timechart itself is over 1 hour.
Now I'd like to have a reference value. A straight, horizontal line with the value of the average over the past week would be perfect. How can I overlay this value?
The "next level" of this would be to save that value and only re-aggregate it every day at midnight so it doesn't use too many resources and affect performance.
The search until now looks like this:
index=msh host="prod*" sourcetype=Message | timechart span=4s avg(Message_DURATION_SMSC) AS ms
Hi! for the command to use, i think you can use this:
index=msh host="prod*" sourcetype=Message | timechart span=4s avg(Message_DURATION_SMSC) AS ms|join [search index=msh host="prod*" sourcetype=Message | timechart span=7d avg(Message_DURATION_SMSC) AS mweek]
here is an example you can use as a template, for your chart overlay. it is using the _internal index. Just copy and test the code.
<dashboard>
<label>Chart Overlay</label>
<description>display the average of the week as a straight line overlay in a timechart</description>
<row>
<panel>
<chart>
<search>
<query>index=_internal sourcetype=splunkd |timechart span=4s avg(active_hist_searches) AS AverageSearch_per_second|join [search index=_internal sourcetype=splunkd |timechart span=7d avg(active_hist_searches) AS AverageSearch_per_week]</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">true</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="charting.chart.overlayFields">AverageSearch_per_week</option>
</chart>
</panel>
</row>
</dashboard>
Hi! for the command to use, i think you can use this:
index=msh host="prod*" sourcetype=Message | timechart span=4s avg(Message_DURATION_SMSC) AS ms|join [search index=msh host="prod*" sourcetype=Message | timechart span=7d avg(Message_DURATION_SMSC) AS mweek]
here is an example you can use as a template, for your chart overlay. it is using the _internal index. Just copy and test the code.
<dashboard>
<label>Chart Overlay</label>
<description>display the average of the week as a straight line overlay in a timechart</description>
<row>
<panel>
<chart>
<search>
<query>index=_internal sourcetype=splunkd |timechart span=4s avg(active_hist_searches) AS AverageSearch_per_second|join [search index=_internal sourcetype=splunkd |timechart span=7d avg(active_hist_searches) AS AverageSearch_per_week]</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">true</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="charting.chart.overlayFields">AverageSearch_per_week</option>
</chart>
</panel>
</row>
</dashboard>
please share more information about your topic