topic Re: trendline wma2 is showing different results between Statistics Table and Single Value in Dashboards & Visualizations

trendline wma2 is showing different results between Statistics Table and Single Value

WEI_LI_YU — Fri, 07 Jul 2017 13:42:51 GMT

Hi splunkers,

I'm using the same query for different panels - timechart, statistics table and single value.
Noticed that the single value is showing the difference between the previous and the current date.
On statistics table the wma2 is working as designed, trendline also.

However, I would like my timechart to show a trendline with the difference between the dates. By having negative difference it should go below Y=0.

Here is the query I'm using:

index=reporting sourcetype=reporting_json alertId=1234
| timechart span=1w count(alertId) as Test
| trendline wma2("x") as trend
| sort - _time

Example of statistics table results:
Date Count WMA
June 7 1593 1976
june 6 2742 2650.3333

On Single value it is showing: 1593 and smaller number on its side, -1,149

Re: trendline wma2 is showing different results between Statistics Table and Single Value

WEI_LI_YU — Fri, 07 Jul 2017 14:35:50 GMT

Found the solution by using delta - http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Delta

It was changed to the below:

index=reporting sourcetype=reporting_json alertId=1234
| timechart span=1w count(alertId) as Test
| delta Test p=1 as Difference

Re: trendline wma2 is showing different results between Statistics Table and Single Value

aaraneta_splunk — Tue, 29 Sep 2020 14:46:40 GMT

@WEI_LI_YU - Glad you were able to find the solution to your question. Please don't forget to click "Accept" to resolve your question so others can find it. Thanks!