I have a query that produces a line chart with two plotlines; I would like to add a trend line for each line.
sourcetype=OktaIM2:log (debugContext.debugData.requestUri=/app/office365/xxxxxxxxxxxxxxxxxxxxxxx/sso/wsfed/active OR debugContext.debugData.requestUri=/app/office365/xxxxxxxxxxxxxxxxxxxxxxx/sso/wsfed/passive) AND debugContext.debugData.requestUri=office AND loginName=*
| timechart span=1d count by debugContext.debugData.requestUri
Thanks!
sample:
index=_internal sourcetype=splunkd_*
| timechart count by sourcetype
| untable _time sourcetype count
| trendline sma5(count) as trend
| xyseries _time sourcetype count trend
try untable
and trendline
sample:
index=_internal sourcetype=splunkd_*
| timechart count by sourcetype
| untable _time sourcetype count
| trendline sma5(count) as trend
| xyseries _time sourcetype count trend
try untable
and trendline