Splunk Search

Timechart - How to add trendlines based on column total

hethu
Path Finder

Hi, I am new to splunk and trying to create a timeline with several individual calculated trend lines, but I simply can not figure out how to. Hopefully someone here is able to help me achieve this.

I have tried the search below which calculates both columns as one total, but i want a total for each eventcode and two separate trend lines

source="*WinEventLog:Security" sourcetype="*wineventlog:security"
EventCode=4624 OR 4625
| timechart count(EventCode) by EventCode
| addtotals row=t
| trendline sma2(Total) as Trend | fields - Total
| rename count(EventCode) as Count
| rename date as date

Timechart

0 Karma

to4kawa
Ultra Champion
source="*WinEventLog:Security" sourcetype="*wineventlog:security"
  EventCode=4624 OR 4625
|timechart count(EventCode) by EventCode
|untable _time EventCode Count
|trendline sma5(Count) as trends
|eventstats sum(Count) as  total by EventCode
0 Karma

dindu
Contributor

Hi ,

Could you try addcoltotals command.

 source="*WinEventLog:Security" sourcetype="*wineventlog:security"
 EventCode=4624 OR 4625
 |timechart count(EventCode) by EventCode
 |addcoltotals labelfield="Total"
0 Karma

hethu
Path Finder

It might be the solution , but how to I use those two columntotals to create two trend lines?
I can not figure out how to select each columntotal for use in trendline

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...