topic Re: Dashboard Studio Single Value with Trendlines in Splunk Enterprise

Dashboard Studio Single Value with Trendlines

chrisboy68 — Mon, 27 Jan 2025 14:58:19 GMT

Hi, struggling to get single values to show with trendline comparing to previous month.

| bin span=1mon _time | chart sum(cost) as monthly_costs over bill_date

Tried differnt varations. The above will show a single value for each month, but I want to add a trendline to the single value to compare to the previous month. Any ideas?

Thanks!

Re: Dashboard Studio Single Value with Trendlines

ITWhisperer — Mon, 27 Jan 2025 17:17:00 GMT

| bin span=1mon _time | chart sum(cost) as monthly_cost over _time

Re: Dashboard Studio Single Value with Trendlines

chrisboy68 — Mon, 27 Jan 2025 18:27:48 GMT

Keep getting "Select a valid trellis split by field", used "_time" and tried "monthly_cost" .

Re: Dashboard Studio Single Value with Trendlines

ITWhisperer — Mon, 27 Jan 2025 18:33:44 GMT

"Trellis"? Where did that come from? Please clarify what you are actually trying to do?

Re: Dashboard Studio Single Value with Trendlines

chrisboy68 — Mon, 27 Jan 2025 19:14:20 GMT

Hi, this https://docs.splunk.com/Documentation/Splunk/9.4.0/DashStudio/trellisLayout. Specifly like this sample. With each month, cost and the trend line comparing to previous month.

Re: Dashboard Studio Single Value with Trendlines

ITWhisperer — Mon, 27 Jan 2025 22:51:36 GMT

So far, you have only mentioned 2 dimensions, cost and time - what else are you breaking your statistics down by?

Re: Dashboard Studio Single Value with Trendlines

chrisboy68 — Tue, 28 Jan 2025 14:43:07 GMT

This is probably why I'm getting confused.

Jan	100
Feb	105
March	90

Given this table, I want to have a single value trellis view that depicts the month total , with a trend compared to the previous month.

Jan 100 (no trend) , Feb 105 (shows trend up 5), March 90 (shows trend down 15).

I'm going to play with timewrap, maybe I'm going down the wrong path.

Re: Dashboard Studio Single Value with Trendlines

MMahlberg — Thu, 12 Feb 2026 10:07:03 GMT

I was struggling with the same task and went down the rabbit hole trying out every known command. The example in the dashboard studio is unfortunately not correct.

Timewrap looks like it could work, but splunk somehow gets confused with it in the foreach command.

This is what i came up with:

``` aggregation over month ``` | eval month = strftime(_time, "%Y-%m") | stats count by month ``` transposing to to get it into right format and adding totals below``` | transpose 0 header_field=month | addcoltotals ``` shifting everything one column to the right if the "column" field is not emty ``` | eval p = "" | foreach 20* [ eval v = '<<FIELD>>', <<FIELD>> = if(isnotnull(column), p, '<<FIELD>>'), p = if(isnotnull(column), v, p) ] | fields - p v ``` splunk NEEDS a _time field for Trellis to work. No idea why ``` | eval _time = now() | table _time 20*

make sure to disable the sparkline and change the trend to percentage.