Can you help me troubleshoot a problem adding a trendline to my query?

[kokanne]

I need to make a report once a month that indicates the trend between the succesful / unsuccesful log-ins on the network. I'm using the authentication data model for this. But when adding a trendline, nothing shows up in the visualization tab. There is only one line.

Can anyone tell me what's going wrong?

| tstats summariesonly=true count from datamodel=Authentication by "Authentication.action" 
| search "Authentication.action"!="unknown" 
| trendline sma5(count) AS trend

[zonistj]

Hi,

I think you need to add the _time field to your by clause and then use timechart followed by the trendline function:

| tstats summariesonly=true count from datamodel=Authentication by "Authentication.action",_time 
| search "Authentication.action"!="unknown" 
| timechart count 
| trendline sma5(count) AS trend

That worked for me.

Edit:

Actually, that didn't work. I just realized it was going off the count of the number of "count" rather than the values you were looking for...

I think this works.

| tstats summariesonly=true count from datamodel=Authentication by "Authentication.action",_time
|rename Authentication.action AS action
| search action!="unknown" 
| timechart sum(count) AS count by action
| trendline sma5(count) AS trend

I renamed the action field to something easier to use and then did a sum of the count from tstats by action. This looked right to me based on the trendline before and after adding the timechart.

[zonistj]

I was just playing around with it and it turns out you don't even need the timechart. You can get it done just by adding the _time field to your by clause:

| tstats summariesonly=true count from datamodel=Authentication by "Authentication.action",_time
| search Authentication.action!="unknown" 
| trendline sma5(count) AS trend