Splunk Search

What is the best way to generate a timechart count and overlay a trendline of expected goal growth?

ahofmann
Explorer

Hi, I want to generate a timechart count of actual values and overlay a trendline of expected goal growth. Basically I want to trend how my data is growing over time with a visual of how I hoped it grew over time.

index=myDownloads
| timechart span=1w count as Downloads

Above, is an example of the base query, and I tried appending static data using a lookup table with prepopulated weekly download numbers to no avail. Before I go too far down this road, is there a way easier way I can plot a simple slope of static values growing 1% each week?

Thank you!

0 Karma

ahofmann
Explorer

I was able to brute-force an inelegant solution to this.
I created a csv of what static values that I wanted the growth to resemble. I added it as a lookup 'staticgrowth.csv'

index=myDownloads
 | timechart span=1w count as ActualDownloads
| appendcols 
[| inputlookup staticgrowth.csv
| eval _time=strptime(date,"%Y-%m-%d")
| eval weekBeginning=relative_time(now(), "-0w@w")
| where _time<weekBeginning
| timechart span=1week values(staticDownloadCount) as GoalDownloads]
0 Karma
Get Updates on the Splunk Community!

Alpha Launch: AI-Assisted Auto-Schematization for CIM

Streamlining Data Onboarding: Announcing the Alpha Release of AI-Assisted Auto-Schematization For many Splunk ...

Enterprise Security(ES) Essentials or Premier? Let's discuss Splunk ES Editions on ...

  Hi everyone, Last year at .conf25, we shared something exciting: Splunk Enterprise Security is evolving ...

[Puzzles] Solve, Learn, Repeat: Advent of Code - Day 5

Advent of CodeIn order to participate in these challenges, you will need to register with the Advent of Code ...