Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Charing three things and something else...

$
0
0
G'Day. I'm trying to get a search and chart working, but it doesn't want to play. The events I'm using are generated hourly and are like this: TROLLY=1 TROLLY_SIZE =150 BAG=1 CONTENTS=15 TROLLY=1 TROLLY_SIZE =150 BAG=2 CONTENTS=25 TROLLY=1 TROLLY_SIZE =150 BAG=3 CONTENTS=10 TROLLY=1 TROLLY_SIZE =150 BAG=4 CONTENTS=10 TROLLY=1 TROLLY_SIZE =150 BAG=5 CONTENTS=15 TROLLY=1 TROLLY_SIZE =150 BAG=6 CONTENTS=20 TROLLY=1 TROLLY_SIZE =150 BAG=7 CONTENTS=25 TROLLY=2 TROLLY_SIZE =100 BAG=1 CONTENTS=15 TROLLY=2 TROLLY_SIZE =100 BAG=2 CONTENTS=15 TROLLY=2 TROLLY_SIZE =100 BAG=3 CONTENTS=10 TROLLY=2 TROLLY_SIZE =100 BAG=4 CONTENTS=10 TROLLY=2 TROLLY_SIZE =100 BAG=5 CONTENTS=15 TROLLY=2 TROLLY_SIZE =100 BAG=6 CONTENTS=20 TROLLY=2 TROLLY_SIZE =100 BAG=7 CONTENTS=10 What I've got at the moment is something that draws an area fill graph of the total contents of all the bags for the selected Trolly. (At the point of time above, Trolly 1 holds 120 items and Trolly 2 holds 95 items. | search TROLLY=$tk_trolly$ | chart sum(CONTENTS) over day_hour by BAG What I want to add is a line that shows the TROLLY_SIZE (basically a straight line at items=150 if Trolly 1 is selected and at 100 if Trolly 2 is selected). There may be more or less than 7 bags in a trolly. Any hints on how to do it? Charting avg(TROLLY_SIZE) get the line repeated for each BAG, sum(TROLLY_SIZE) gets me a line that's to big... Mik

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>