topic Re: How to add sparkline and trend time to a single value visualization? in Dashboards & Visualizations

How to add sparkline and trend time to a single value visualization?

dchalasani — Wed, 17 May 2017 16:55:51 GMT

Hi,

I want to add a sparkline and trend time for a single value.

Can any one please help me how to do it? Below is the search string and source code.

Please correct this.

Thanks!

index=aws sourcetype=description alert_risk_level=high| stats count as alert_risk_level   |eval alert_risk_level=($alert_risk_level$/1000)|eval alert_risk_level=round(alert_risk_level,2)

Source code

<panel>
  <single>
    <search>
      <query>index=aws sourcetype=description  | stats count as alert_risk_level  |eval alert_risk_level=($$alert_risk_level$$/1000)|eval alert_risk_level=round(alert_risk_level,2)</query>
      <earliest>-60m@m</earliest>
      <latest>now</latest>
      <sampleRatio>1</sampleRatio>
    </search>
    <option name="colorMode">none</option>
    <option name="drilldown">all</option>
    <option name="rangeColors">["0x65a637","0x040751"]</option>
    <option name="rangeValues">[0]</option>
    <option name="underLabel">Risk Identified</option>
    <option name="unit">K</option>
    <option name="unitPosition">after</option>
    <option name="useColors">1</option>
    <option name="useThousandSeparators">0</option>
  </single>
</panel>
<panel>
  <single>

Re: How to add sparkline and trend time to a single value visualization?

rphillips_splk — Wed, 17 May 2017 17:32:58 GMT

@dchalasani is there a reason you need to use sparkline instead of timechart ? Here is an example using timechart if you decide that is acceptable

index=aws sourcetype=description alert_risk_level=high | stats count as alert_risk_level by _time | eval alert_risk_level=alert_risk_level/1000  | eval alert_risk_level=round(alert_risk_level,2) | timechart span=1m max(alert_risk_level)

Re: How to add sparkline and trend time to a single value visualization?

dchalasani — Wed, 17 May 2017 17:40:14 GMT

https://image.slidesharecdn.com/splunkninjas6-151021001013-lva1-app6891/95/splunk-ninjas-new-features-pivot-and-search-dojo-12-638.jpg?cb=1445386361

Please open the above link.

Is this possible?

Re: How to add sparkline and trend time to a single value visualization?

dchalasani — Wed, 17 May 2017 18:14:34 GMT

And can we change in source-code for sparkline..

Re: How to add sparkline and trend time to a single value visualization?

niketn — Wed, 17 May 2017 19:14:00 GMT

Please convert the query to timechart instead of stats.

   <query>index=aws sourcetype=description | timechart count as alert_risk_level  |eval alert_risk_level=($$alert_risk_level$$/1000)|eval alert_risk_level=round(alert_risk_level,2)</query>

You need to show Trend Indicator and Sparkline. You can do both of this directly from Splunk UI by Editing Single Value Properties from the Format menu. Unless you have already done, requesting you to get Splunk 6.x Dashboard Examples App from Splunkbase (https://splunkbase.splunk.com/app/1603/) also refer to customizing Single Value documentation http://docs.splunk.com/Documentation/Splunk/latest/Viz/SingleValueFormatting.

If you want to do it through Simple XML, please refer to the following Documentation:
look for trend related configurations and set showSparkline to true to show Spark Line.
https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#single_value

Re: How to add sparkline and trend time to a single value visualization?

rphillips_splk — Wed, 17 May 2017 19:38:06 GMT

here is source code example for single value element with sparkline and trend indicator:

<dashboard>
  <label>Single Value Element With Sparkline and Trend Indicator</label>
  <row>
    <panel>
      <single>
        <title>With Sparkline and Trend Indicator</title>
        <search>
          <query>index=aws sourcetype=description alert_risk_level=high | timechart count as alert_risk_level  | eval alert_risk_level=alert_risk_level/1000  | eval alert_risk_level=round(alert_risk_level,2) </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="trendInterval">-1h</option>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="numberPrecision">0</option>
        <option name="showTrendIndicator">1</option>
        <option name="showSparkline">1</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
        <option name="underLabel">Compared to an hour before</option>
        <option name="drilldown">none</option>
      </single>
    </panel>

  </row>
</dashboard>