How to edit my timechart search to display a trendline for an unknown count of SSIDs?

[_smp_]

I have the following search which creates a timechart:

index=ise vendor_action=Failed_Attempts MESSAGE_CODE=5400
| timechart span=1m count by SSID

The trendline works fine, if I know what the SSID values are:

index=ise vendor_action=Failed_Attempts MESSAGE_CODE=5400
| timechart span=1m count by SSID
| trendline sma5(SSID_1), sma5(SSID_2), sma5(SSID_3)

Is there a way to display a trendline for a variable or unknown number of SSIDs?

[gokadroid]

How about trying the trendline with the fieldName which houses all these SSIDs in it. See example here which is exactly working on field foo and bar where there might be unknown number of values for field foo and bar.

... | trendline sma5(SSID) AS smoothed_SSID

It will take the sma5 considering all the values and might not give the sma5 for each one of them as an individual line.

[_smp_]

I tried your syntax. When I go to the Chart Overlay options to add the trendline as an overlay, the values of the SSID field are all available to select in the Overlay dropdown. But when I add one of the values, the trendline ends up simply following the top value of that chart. In other words, the trendline looks like count instead of sma5.

The value smoothed_SSID is not available to select in the dropdown, but when I enter it in anyway, the timechart doesn't appear to be any different.