Splunk Enterprise Security

Can you help me troubleshoot a problem adding a trendline to my query?

Communicator

I need to make a report once a month that indicates the trend between the succesful / unsuccesful log-ins on the network. I'm using the authentication data model for this. But when adding a trendline, nothing shows up in the visualization tab. There is only one line.

Can anyone tell me what's going wrong?

| tstats summariesonly=true count from datamodel=Authentication by "Authentication.action" 
| search "Authentication.action"!="unknown" 
| trendline sma5(count) AS trend

alt text

Path Finder

Hi,

I think you need to add the _time field to your by clause and then use timechart followed by the trendline function:

| tstats summariesonly=true count from datamodel=Authentication by "Authentication.action",_time 
| search "Authentication.action"!="unknown" 
| timechart count 
| trendline sma5(count) AS trend

That worked for me.

Edit:

Actually, that didn't work. I just realized it was going off the count of the number of "count" rather than the values you were looking for...

I think this works.

| tstats summariesonly=true count from datamodel=Authentication by "Authentication.action",_time
|rename Authentication.action AS action
| search action!="unknown" 
| timechart sum(count) AS count by action
| trendline sma5(count) AS trend

I renamed the action field to something easier to use and then did a sum of the count from tstats by action. This looked right to me based on the trendline before and after adding the timechart.

0 Karma

Path Finder

I was just playing around with it and it turns out you don't even need the timechart. You can get it done just by adding the _time field to your by clause:

| tstats summariesonly=true count from datamodel=Authentication by "Authentication.action",_time
| search Authentication.action!="unknown" 
| trendline sma5(count) AS trend
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!