https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-trendline-that-overlays-my-area-chart/m-p/218088#M64107 <P>I've been looking at other answers and tried this</P> <P><CODE>eventtype=cv "Source Client"=* "Destination Client"=slc-p-res* OR dab* Duration=* | convert dur2sec(Duration) AS Durationsec | eval Durationhrs=round(Durationsec/60/60,2) | fields - "Destination Client" | timechart span=1d avg(Durationhrs) | addtotals row=t | trendline sma5(Total) AS Trend | fields - Total</CODE></P> <P>But I am not exactly certain what I am doing here. It seems to work the way I want it to, but I am not sure what the <CODE>row=t</CODE> part does</P> Tue, 03 Jan 2017 23:05:12 GMT HCadmins 2017-01-03T23:05:12Z https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-trendline-that-overlays-my-area-chart/m-p/218087#M64106 <PRE><CODE>eventtype=cv "Source Client"=* "Destination Client"=slc-p-res* OR dab* Duration=* | convert dur2sec(Duration) AS Durationsec | eval Durationhrs=round(Durationsec/60/60,2) | fields - "Destination Client" | timechart span=1d avg(Durationhrs) | trendline sma5(Durationhrs) AS Trend </CODE></PRE> <P>This currently shows an area chart with 1 day periods and their average durations (which is what I want).</P> <P>Can I also show a trendline overlay? I am confused about whether this trendline statement is doing anything, as no new fields are created and no trendline shows up. </P> <P>Thanks in advance.</P> Tue, 03 Jan 2017 22:02:23 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-trendline-that-overlays-my-area-chart/m-p/218087#M64106 HCadmins 2017-01-03T22:02:23Z https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-trendline-that-overlays-my-area-chart/m-p/218088#M64107 <P>I've been looking at other answers and tried this</P> <P><CODE>eventtype=cv "Source Client"=* "Destination Client"=slc-p-res* OR dab* Duration=* | convert dur2sec(Duration) AS Durationsec | eval Durationhrs=round(Durationsec/60/60,2) | fields - "Destination Client" | timechart span=1d avg(Durationhrs) | addtotals row=t | trendline sma5(Total) AS Trend | fields - Total</CODE></P> <P>But I am not exactly certain what I am doing here. It seems to work the way I want it to, but I am not sure what the <CODE>row=t</CODE> part does</P> Tue, 03 Jan 2017 23:05:12 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-trendline-that-overlays-my-area-chart/m-p/218088#M64107 HCadmins 2017-01-03T23:05:12Z https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-trendline-that-overlays-my-area-chart/m-p/218089#M64108 <P>check out the overlay option in the chart settings.</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/Chartcontrols">https://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/Chartcontrols</A></P> <P>It allows you to choose a field returned by your search to be overlayed. Should do the trick for the searches you have shared</P> Wed, 04 Jan 2017 00:08:52 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-trendline-that-overlays-my-area-chart/m-p/218089#M64108 mattymo 2017-01-04T00:08:52Z https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-trendline-that-overlays-my-area-chart/m-p/218090#M64109 <P>The addtotals command can perform total of both row or column based on numeric fields. row=t will perform sum of all the rows. Ideally it would have been useful if your timechart command had a split field which I don't see. Hence may be the command will work the same even if you take out addtotals command.</P> <P>If you want totals of numeric column then you can write <STRONG>addtotals col=t labelfield=_time</STRONG><BR /> Alternatively you can also use addcoltotals command which is similar to addtotals but works only on numeric columns.</P> <P>If the trendline command is working as expected for you that is great, but you can also evaluate predict and kmeans commands for trending and prediction.</P> Wed, 04 Jan 2017 06:58:20 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-trendline-that-overlays-my-area-chart/m-p/218090#M64109 niketn 2017-01-04T06:58:20Z https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-trendline-that-overlays-my-area-chart/m-p/218091#M64110 <P>When removing the <CODE>addtotals</CODE> command, the trendline column disappears, thus it's not what I am trying to do.</P> <P>When including the <CODE>addtotals row=t</CODE> makes a trendline column with values in it. I'm just not sure where it's getting those values. Could you take a look?</P> <P><IMG src="http://i67.tinypic.com/2mzcsc6.png" alt="alt text" /></P> Wed, 04 Jan 2017 16:09:56 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-trendline-that-overlays-my-area-chart/m-p/218091#M64110 HCadmins 2017-01-04T16:09:56Z