Splunk Search

How to edit my timechart search to display a trendline for an unknown count of SSIDs?

_smp_
Builder

I have the following search which creates a timechart:

index=ise vendor_action=Failed_Attempts MESSAGE_CODE=5400
| timechart span=1m count by SSID

The trendline works fine, if I know what the SSID values are:

index=ise vendor_action=Failed_Attempts MESSAGE_CODE=5400
| timechart span=1m count by SSID
| trendline sma5(SSID_1), sma5(SSID_2), sma5(SSID_3)

Is there a way to display a trendline for a variable or unknown number of SSIDs?

0 Karma

gokadroid
Motivator

How about trying the trendline with the fieldName which houses all these SSIDs in it. See example here which is exactly working on field foo and bar where there might be unknown number of values for field foo and bar.

... | trendline sma5(SSID) AS smoothed_SSID

It will take the sma5 considering all the values and might not give the sma5 for each one of them as an individual line.

0 Karma

_smp_
Builder

I tried your syntax. When I go to the Chart Overlay options to add the trendline as an overlay, the values of the SSID field are all available to select in the Overlay dropdown. But when I add one of the values, the trendline ends up simply following the top value of that chart. In other words, the trendline looks like count instead of sma5.

The value smoothed_SSID is not available to select in the dropdown, but when I enter it in anyway, the timechart doesn't appear to be any different.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...