Dashboards & Visualizations

trendline won't display

nikmeiser
Explorer

I have a simple trendline to track storage growth I want to display. I'm using the following syntax. There are no errors but the trendline won't display -

tag="host01" | eval MOUNTPT=mvfilter(match(MOUNTPT, "^/d/")) | eval USEDGB=round(X_USED/(1024*1024),2) | timechart max(USEDGB) | trendline sma5(USEDGB) as trend

Any ideas what I'm doing wrong?

Tags (1)
0 Karma
1 Solution

nikmeiser
Explorer

Figured it out. It needed a function around the field. This works -

tag="host01" | eval MOUNTPT=mvfilter(match(MOUNTPT, "^/d/")) | eval USEDGB=round(X_USED/(1024*1024),2) | timechart max(USEDGB) | trendline sma5(max(USEDGB)) as trend

View solution in original post

nikmeiser
Explorer

Figured it out. It needed a function around the field. This works -

tag="host01" | eval MOUNTPT=mvfilter(match(MOUNTPT, "^/d/")) | eval USEDGB=round(X_USED/(1024*1024),2) | timechart max(USEDGB) | trendline sma5(max(USEDGB)) as trend
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...