I have the following search which creates a timechart:
index=ise vendor_action=Failed_Attempts MESSAGE_CODE=5400
| timechart span=1m count by SSID
The trendline works fine, if I know what the SSID values are:
index=ise vendor_action=Failed_Attempts MESSAGE_CODE=5400
| timechart span=1m count by SSID
| trendline sma5(SSID_1), sma5(SSID_2), sma5(SSID_3)
Is there a way to display a trendline for a variable or unknown number of SSIDs?
How about trying the trendline
with the fieldName
which houses all these SSIDs
in it. See example here which is exactly working on field foo
and bar
where there might be unknown number of values for field foo
and bar
.
... | trendline sma5(SSID) AS smoothed_SSID
It will take the sma5
considering all the values and might not give the sma5
for each one of them as an individual line.
I tried your syntax. When I go to the Chart Overlay options to add the trendline as an overlay, the values of the SSID field are all available to select in the Overlay dropdown. But when I add one of the values, the trendline ends up simply following the top value of that chart. In other words, the trendline looks like count
instead of sma5
.
The value smoothed_SSID
is not available to select in the dropdown, but when I enter it in anyway, the timechart doesn't appear to be any different.