How to edit my search to add a trend line to a Splunk line chart?

[steveskinner]

Hi,

I'm trying to add a trend line to my splunk line chart, but no trend line is appearing.

Original search string:

(host="pvawbdqt01.xxx.co.uk") index="bluedoor_query_tool_perfmon" source="Perfmon:Processor" counter="% Processor Time" | 
replace "pvawbdqt01.xxx.co.uk" with "pvawbdqt01" in host | 
timechart max(Value) by host

New updated string that's not producing trend line:

(host="pvawbdqt01.xxx.co.uk") index="bluedoor_query_tool_perfmon" source="Perfmon:Processor" counter="% Processor Time" | 
replace "pvawbdqt01.xxx.co.uk" with "pvawbdqt01" in host | 
timechart max(Value) as max_value by host | trendline sma5(max_value) as trend

Can someone please explain how I get the trend line to work please?

[somesoni2 · Accepted solution]

The trendline command applies on a field existing on the result set. In your search, after the timechart command, the available fields are _time and fields with name same as host, so the max_value field doesn't exist and the trendline doesn't work.

Assuming that you're running this search for just one host ("pvawbdqt01.xxx.co.uk" per you search in the question), try something like this

(host="pvawbdqt01.xxx.co.uk") index="bluedoor_query_tool_perfmon" source="Perfmon:Processor" counter="% Processor Time" | 
 replace "pvawbdqt01.xxx.co.uk" with "pvawbdqt01" in host | 
 timechart max(Value) as max_value by host | trendline sma5(pvawbdqt01) as trend

[steveskinner]

That has done the trick - many thanks for your help on this :O)