Can I make a trendline that overlays my area chart?

[HCadmins]

eventtype=cv "Source Client"=* "Destination Client"=slc-p-res* OR dab* Duration=* | convert dur2sec(Duration) AS Durationsec | eval Durationhrs=round(Durationsec/60/60,2) | fields - "Destination Client" | timechart span=1d avg(Durationhrs) | trendline sma5(Durationhrs) AS Trend

This currently shows an area chart with 1 day periods and their average durations (which is what I want).

Can I also show a trendline overlay? I am confused about whether this trendline statement is doing anything, as no new fields are created and no trendline shows up.

Thanks in advance.

[niketn]

The addtotals command can perform total of both row or column based on numeric fields. row=t will perform sum of all the rows. Ideally it would have been useful if your timechart command had a split field which I don't see. Hence may be the command will work the same even if you take out addtotals command.

If you want totals of numeric column then you can write addtotals col=t labelfield=_time
Alternatively you can also use addcoltotals command which is similar to addtotals but works only on numeric columns.

If the trendline command is working as expected for you that is great, but you can also evaluate predict and kmeans commands for trending and prediction.

[HCadmins]

When removing the addtotals command, the trendline column disappears, thus it's not what I am trying to do.

When including the addtotals row=t makes a trendline column with values in it. I'm just not sure where it's getting those values. Could you take a look?

[mattymo]

check out the overlay option in the chart settings.

https://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/Chartcontrols

It allows you to choose a field returned by your search to be overlayed. Should do the trick for the searches you have shared

[HCadmins]

I've been looking at other answers and tried this

eventtype=cv "Source Client"=* "Destination Client"=slc-p-res* OR dab* Duration=* | convert dur2sec(Duration) AS Durationsec | eval Durationhrs=round(Durationsec/60/60,2) | fields - "Destination Client" | timechart span=1d avg(Durationhrs) | addtotals row=t | trendline sma5(Total) AS Trend | fields - Total

But I am not exactly certain what I am doing here. It seems to work the way I want it to, but I am not sure what the row=t part does