Splunk Search

Error: Trendline command: invalid Trendline period for 'sma(count)'

maverick
Splunk Employee
Splunk Employee

I am running the following search in the Splunk Search GUI:

* daysago=30  |timechart count| trendline sma(count)as thecount

and I am receiving an error in red that says the trendline has an invalid trendline period for argument 'sma(count)'

Does anyone know what this means and, hopefully, how to correct?

0 Karma

Paolo_Prigione
Builder

Shouldn't that be

sma5(count) 

with 5 (or other) being the window used for the average?

Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...