Dashboards & Visualizations

Show trendline of average of values for 1hour as overlay graph on main graph

deepthi5
Path Finder

alt textHi ,

I have one graph which shows the response times for every second
source="C:\Ping\" index="ping" sourcetype="pingstats" | rex field=source "(?.?)$" |lookup pinglookup.csv country OUTPUT router DestinationIP |search router=waterloo|chart values(RTT) as RTT by _time,router|fillnull value=0

I have another graph which shows the trend of the average of the response times for one hour
source="C:\Ping\" index="ping" sourcetype="pingstats" | rex field=source "(?.?)$" |lookup pinglookup.csv country OUTPUT router DestinationIP |search router=waterloo | bucket _time span=1h | stats avg(RTT) AS avg_value by _time | trendline sma5(avg_value) as trend

How can i combine both and get a graph i have used appendcols but the graph looks odd

attaching the screen shot

Tags (2)
0 Karma

sundareshr
Legend

Try this

source="C:\\Ping\*" index="ping" sourcetype="pingstats" | rex field=source "(?.*?)$" | lookup pinglookup.csv country OUTPUT router DestinationIP | search router=waterloo | chart values(RTT) as RTT by _time,router | fillnull value=0 | addtotals | trendline sma5(Total) as Trend | fields - Total
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...