topic Re: Visualisation : Single Value with Trendline in Splunk Enterprise Security

Visualisation : Single Value with Trendline

syazwani — Mon, 18 Oct 2021 04:53:37 GMT

Hi,

Im trying to create a single value with trendline visualisation, where I want to compare the difference between todays result with yesterday results. The trendline should be the results difference of yesterday and today.

I have applied several solutions, but the total number does not tally with the today's result.

My base query is:

index=emailgateway action=* from!="" to!=""
| stats count

which result shown as (today result) :

Base

Here are several solutions that I have tried:-

Solution 1

Im using the trendline wma2

index=emailgateway action=* from!="" to!=""
| timechart span=1d count as Total
| trendline wma2("x") as Trend
| sort - _time

the result shown as below:

Solution 1

- the result shows the trendline, but the total number (90,702) did not tally with today's result (227,019).

Solution 2

Im using the delta command :-

index=emailgateway action=* from!="" to!=""
| timechart span=1d count as Total
| delta Total p=1 as diference

the result shown as below:

- the total number is different (including the trendline number)

Solution 3

I tried to use the |tstats command (from Enterprise Security)

| tstats summariesonly=true allow_old_summaries=true count from datamodel=Email where (All_Email.action=* AND All_Email.orig_dest!="" OR All_Email.orig_src!="") earliest=-48h latest=-24h
| append
[| tstats summariesonly=true allow_old_summaries=true count from datamodel=Email where (All_Email.action=* AND All_Email.orig_dest!="" OR All_Email.orig_src!="") earliest=-24h latest=now]
| appendcols
[| makeresults
| eval time=now()
]
| rename time AS _time

Solution 3

- which also did not work

Can anyone help? Did i missed anything? Please.

Re: Visualisation : Single Value with Trendline

Chef — Tue, 19 Oct 2021 05:14:29 GMT

Hi syazwani,

What timeframes are you specifying for your searches? I suspect that's the reason why you're getting inconsistencies in your search.

In your enterprise security search you're specifying a 24 hour time period:

earliest=-48h latest=-24h

Which will give you different results depending on the time you run it.

Try the following:

Todays current total:

index=emailgateway action=* from!="" to!="" earliest=@d | stats count

Compare yesterday and today:

index=emailgateway action=* from!="" to!="" earliest=-1d@d | timechart span=1d count as total

Simpler tstats command:

| tstats summariesonly=true allow_old_summaries=true count from datamodel=Email where All_Email.action=* All_Email.orig_dest!="" All_Email.orig_src!="" earliest=-1d@d latest=now by _time span=1d

Using earliest=-1d@d will take the search back to the beginning of yesterday (12:00am). Whereas using earliest=@d will take you to the beginning of the current day.

Hope this helps!

Re: Visualisation : Single Value with Trendline

syazwani — Wed, 20 Oct 2021 05:37:42 GMT

Hi chef,

Yeah I messed up with the timeframes 🙂 Im using the comparison query and its working fine. Thankyou. This really helps me a lot. Thankyou again sir.