https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-a-line-of-an-average-over-the-last/m-p/228702#M67667 <P>Yes, there are lots of ways. A simple way would be to use <CODE>trendline</CODE>:</P> <PRE><CODE>host=CATSG14 "INTGWAUTH" AND "Failed login" earliest=-30d@d latest=now | timechart span=1h count | trendline sma5(count) as 5hour_average </CODE></PRE> <P>You can change the 5 of <CODE>sma5</CODE> to something else, e.g. a 24 hour average with <CODE>| trendline sma24(count)</CODE></P> <HR /> <P>Docs for <CODE>trendline</CODE> can be found <A href="http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/trendline">here</A>.</P> Mon, 11 Jan 2016 15:30:39 GMT aljohnson_splun 2016-01-11T15:30:39Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-a-line-of-an-average-over-the-last/m-p/228701#M67666 <P>Hi helpful people,</P> <P>I wish to display on a column graph an average line for my search. My current search is as follows:-</P> <PRE><CODE>host=CATSG14 "INTGWAUTH" AND "Failed login" earliest=-30d@d latest=now | timechart span=1d count </CODE></PRE> <P>Is there anyway to show an average bar on the graph? Any help will be truly appreciated.</P> Mon, 11 Jan 2016 15:24:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-a-line-of-an-average-over-the-last/m-p/228701#M67666 SecureIA 2016-01-11T15:24:33Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-a-line-of-an-average-over-the-last/m-p/228702#M67667 <P>Yes, there are lots of ways. A simple way would be to use <CODE>trendline</CODE>:</P> <PRE><CODE>host=CATSG14 "INTGWAUTH" AND "Failed login" earliest=-30d@d latest=now | timechart span=1h count | trendline sma5(count) as 5hour_average </CODE></PRE> <P>You can change the 5 of <CODE>sma5</CODE> to something else, e.g. a 24 hour average with <CODE>| trendline sma24(count)</CODE></P> <HR /> <P>Docs for <CODE>trendline</CODE> can be found <A href="http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/trendline">here</A>.</P> Mon, 11 Jan 2016 15:30:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-a-line-of-an-average-over-the-last/m-p/228702#M67667 aljohnson_splun 2016-01-11T15:30:39Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-a-line-of-an-average-over-the-last/m-p/228703#M67668 <P>thanks for your reply aljohnson!! I tried this, however I simply get another bar instead of a trendline <span class="lia-unicode-emoji" title=":confused_face:">😕</span></P> Mon, 11 Jan 2016 15:36:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-a-line-of-an-average-over-the-last/m-p/228703#M67668 SecureIA 2016-01-11T15:36:55Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-a-line-of-an-average-over-the-last/m-p/228704#M67669 <P>You would have to select the overlay option to set the new field as overlay field. See here</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.1/Viz/Chartcontrols#Chart_overlay_example_.28dual_axis.29">http://docs.splunk.com/Documentation/Splunk/6.1/Viz/Chartcontrols#Chart_overlay_example_.28dual_axis.29</A></P> Mon, 11 Jan 2016 16:22:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-a-line-of-an-average-over-the-last/m-p/228704#M67669 somesoni2 2016-01-11T16:22:37Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-a-line-of-an-average-over-the-last/m-p/228705#M67670 <P>Thanks alot guys, I managed this <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 12 Jan 2016 09:45:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-a-line-of-an-average-over-the-last/m-p/228705#M67670 SecureIA 2016-01-12T09:45:17Z