Splunk Search

Timechart - How to add trendlines based on column total

hethu
Path Finder

Hi, I am new to splunk and trying to create a timeline with several individual calculated trend lines, but I simply can not figure out how to. Hopefully someone here is able to help me achieve this.

I have tried the search below which calculates both columns as one total, but i want a total for each eventcode and two separate trend lines

source="*WinEventLog:Security" sourcetype="*wineventlog:security"
EventCode=4624 OR 4625
| timechart count(EventCode) by EventCode
| addtotals row=t
| trendline sma2(Total) as Trend | fields - Total
| rename count(EventCode) as Count
| rename date as date

Timechart

0 Karma

to4kawa
Ultra Champion
source="*WinEventLog:Security" sourcetype="*wineventlog:security"
  EventCode=4624 OR 4625
|timechart count(EventCode) by EventCode
|untable _time EventCode Count
|trendline sma5(Count) as trends
|eventstats sum(Count) as  total by EventCode
0 Karma

dindu
Contributor

Hi ,

Could you try addcoltotals command.

 source="*WinEventLog:Security" sourcetype="*wineventlog:security"
 EventCode=4624 OR 4625
 |timechart count(EventCode) by EventCode
 |addcoltotals labelfield="Total"
0 Karma

hethu
Path Finder

It might be the solution , but how to I use those two columntotals to create two trend lines?
I can not figure out how to select each columntotal for use in trendline

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...