How to create trendline for aggregated values?

[AndreasLasses]

Hello!

I am currently trying to create a dashboard (Splunk Enterprise Dashboard Beta) where I aggregate values from multiple repositories in a single value panel to get a total value. My issue is that I want to have a trendline of these aggregated values. Is there a way to achieve this?
My current (non-trendline) query looks like this:

index="my-index" repo= *
|chart latest(***.***.***.Summary) as "Summary" by repo
| eval total = sum(Summary)
| stats sum(Summary) as "Aggregated Summary"

Thanks in advance.

[ITWhisperer]

It is not clear what you are attempting to achieve here as your chart is by repo but your stats has no by clause.

Having said that, for a trendline, you need a time component.

Just taking the first part of your search, try this

| timechart span=5m latest(***.***.***.Summary) as Summary by repo

Use a relevant time span of course.

You can visualise this as a single and you could use trellis to get a single (with trendline) for each repo.

If you still want a trendline for the total for all repos, you could do something like this

| bin _time span=5m
| stats latest(***.***.***.Summary) as Summary by _time repo
| timechart span=5m sum(Summary) as Total

[AndreasLasses]

Thank you for your answer. Maybe I wasn't clear enough.

So what I want to do is I want to retrieve the values from EACH repo and add the values together into a new value. If repo1 and repo2 boh have "Summary" of 5, I want the aggregated value to show 10. This I have already achieved with the aforementioned query, but what I have not achieved is getting a trendline for this value.

[ITWhisperer]

How does what I suggested not do what you want?

[AndreasLasses]

It does give me a trendline, so the suggestion is not wrong. The issue is that these logs are created infrequently and there can sometimes be several days where no updates are happening and some days more than one update will be done on several repos. So what I get here will be the summary of the last day when an update happened, and only for those particular repos that were updated on that day.

What I would want is the summary of the latest run for each repo aggregated in a value with a trendline, regardless of the day it was updated. Now that I am writing my issue I realize that this will probably be next to impossible to achieve without somehow manipulating the data I send to Splunk.