Hi helpful people,
I wish to display on a column graph an average line for my search. My current search is as follows:-
host=CATSG14 "INTGWAUTH" AND "Failed login" earliest=-30d@d latest=now | timechart span=1d count
Is there anyway to show an average bar on the graph? Any help will be truly appreciated.
Yes, there are lots of ways. A simple way would be to use trendline
:
host=CATSG14 "INTGWAUTH" AND "Failed login" earliest=-30d@d latest=now
| timechart span=1h count
| trendline sma5(count) as 5hour_average
You can change the 5 of sma5
to something else, e.g. a 24 hour average with | trendline sma24(count)
Docs for trendline
can be found here.
Yes, there are lots of ways. A simple way would be to use trendline
:
host=CATSG14 "INTGWAUTH" AND "Failed login" earliest=-30d@d latest=now
| timechart span=1h count
| trendline sma5(count) as 5hour_average
You can change the 5 of sma5
to something else, e.g. a 24 hour average with | trendline sma24(count)
Docs for trendline
can be found here.
thanks for your reply aljohnson!! I tried this, however I simply get another bar instead of a trendline 😕
Thanks alot guys, I managed this 🙂
You would have to select the overlay option to set the new field as overlay field. See here