Dashboards & Visualizations

How to add a trend line to a line chart with 2 lines?

joeferranti99
New Member

I have a query that produces a line chart with two plotlines; I would like to add a trend line for each line.

sourcetype=OktaIM2:log (debugContext.debugData.requestUri=/app/office365/xxxxxxxxxxxxxxxxxxxxxxx/sso/wsfed/active OR debugContext.debugData.requestUri=/app/office365/xxxxxxxxxxxxxxxxxxxxxxx/sso/wsfed/passive) AND debugContext.debugData.requestUri=office AND loginName=*
| timechart span=1d count by debugContext.debugData.requestUrialt text

Thanks!

Labels (1)
Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion

sample:

index=_internal sourcetype=splunkd_*
| timechart count by sourcetype
| untable _time sourcetype count
| trendline sma5(count) as trend
| xyseries _time sourcetype count trend

try untable and trendline

View solution in original post

0 Karma

to4kawa
Ultra Champion

sample:

index=_internal sourcetype=splunkd_*
| timechart count by sourcetype
| untable _time sourcetype count
| trendline sma5(count) as trend
| xyseries _time sourcetype count trend

try untable and trendline

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...