Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Annotation of graph not working when i use the below command.

$
0
0
Hi all. I'm facing some issues in displaying annotations for my graphs. I suspect that something is wrong when I use 2 STREAMSTATS command. My annotation for that particular graph seems to stop working. When I run this code, it works! index="alarm" | streamstats avg(alarmcount) as average stdev(alarmcount) as standev | eval threeSigmaLimit = (average + (standev * 3)) | where alarmcount > threeSigmaLimit | eval annotation_label = index | eval annotation_color = "0xff9900" | table _time annotation_label alarmcount $field1.earliest$$field1.latest$ However, when I run this code. The annotation disappears. index="alarm" | streamstats window=2 min(alarmcount3) as minimum | eval is_increase=if(alarmcount3!=minimum,1,0) | streamstats window=7 sum(is_increase) as increases | where increases>=7 | eval increase_index = index2 - 6 | eval annotation_label = increase_index| eval annotation_color = "0xff9900" | table _time annotation_label alarmcount3 $field1.earliest$$field1.latest$ any idea whY??

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>