Dashboards & Visualizations

Add trendline to timechart splunk

karthi25
Path Finder

I am having the chart with durations, Now I want add a line over the chart with values as avg(duration). I used below query, but its not showing up trendline

index=cloudfoundry sourcetype=cloudfoundry_apps "cf_foundation=px-npe01" "cf_org_name=Commissions" "cf_space_name=development" "cf_app_name=splunk**   |search endDate !=null AND status='COMPLETED' |eval start_epoch=strptime(startDate,"%Y-%m-%d %H:%M:%S.%1N")
     |eval _time=start_epoch
     |eval end_epoch=strptime(endDate,"%Y-%m-%d %H:%M:%S.%1N")
     |eval duration=round((end_epoch-start_epoch)/3600)
      | chart values(duration) as duration by processLogId | trendline sma5(duration) as sma_Max_Resp

My expectation will be as followsalt text

0 Karma
1 Solution

mayurr98
Super Champion

hey try this!

index=cloudfoundry sourcetype=cloudfoundry_apps "cf_foundation=px-npe01" "cf_org_name=Commissions" "cf_space_name=development" "cf_app_name=splunk**   
|search endDate !=null AND status='COMPLETED' |eval start_epoch=strptime(startDate,"%Y-%m-%d %H:%M:%S.%1N")
      |eval _time=start_epoch
      |eval end_epoch=strptime(endDate,"%Y-%m-%d %H:%M:%S.%1N")
      |eval duration=round((end_epoch-start_epoch)/3600)
       | chart values(duration) as duration by processLogId | eventstats avg(duration) as avg_duration

just add eventstats avg(duration) as avg_duration at the end of your query instead of trendline command.

let me know if this helps you!

View solution in original post

mayurr98
Super Champion

hey try this!

index=cloudfoundry sourcetype=cloudfoundry_apps "cf_foundation=px-npe01" "cf_org_name=Commissions" "cf_space_name=development" "cf_app_name=splunk**   
|search endDate !=null AND status='COMPLETED' |eval start_epoch=strptime(startDate,"%Y-%m-%d %H:%M:%S.%1N")
      |eval _time=start_epoch
      |eval end_epoch=strptime(endDate,"%Y-%m-%d %H:%M:%S.%1N")
      |eval duration=round((end_epoch-start_epoch)/3600)
       | chart values(duration) as duration by processLogId | eventstats avg(duration) as avg_duration

just add eventstats avg(duration) as avg_duration at the end of your query instead of trendline command.

let me know if this helps you!

karthi25
Path Finder

@mayurr98 if I want a line in a column chart.. What can I do?? I tried changing the chart type but that average is in a bar shape not a line

0 Karma

mayurr98
Super Champion

as per my knowledge, it will not create a line in column chart this solution is only meant for line chart!

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...