topic Re: How can I set time in a single value panel while respecting delta time? in Dashboards & Visualizations

How can I set time in a single value panel while respecting delta time?

gcusello — Tue, 19 Sep 2017 08:51:47 GMT

Hi at all,
I'd like to show trends in Single Value panels.
Following the example in Splunk 6.x dashboard Examples App, I used a timechart command

my_search
| timechart count bins=2

but the problem is that in this way I give an information different from all the other panels in my dashboard, because, setting last hour in the Time Picker, I show events in the last hour in all the panels and events in the last half hour in Single Value Panels!
What is the best way to proceed: set a double time in Single Value Panels or Timewrap or another solution?

How can I set double time in the Single Value panels?
I tried also with Timewrap command but in this command I cannot manage delta time.

Has someone any idea how to solve this problem?

Thank you in advance.
Bye.
Giuseppe

Re: How can I set time in a single value panel while respecting delta time?

Sukisen1981 — Tue, 19 Sep 2017 09:57:37 GMT

Something like this ?
earliest=-2h
| timechart count bins=2 | reverse | head 2 | reverse

this gives me a single value hourly trend

Re: How can I set time in a single value panel while respecting delta time?

gcusello — Tue, 19 Sep 2017 10:04:33 GMT

Thank you Sukisen1981,
the problem is that in my dashboard I need the Time Picket to set the Time in the dashboard.
So if I set 2 hours in the Time Picker, the other panels show events of 2 hours and Single Value panels show events of 1 hour, this solution doesn't solve my problem: the time picker.
Thank you.
Bye.
Giuseppe

Re: How can I set time in a single value panel while respecting delta time?

Sukisen1981 — Tue, 19 Sep 2017 10:20:49 GMT

hmm so your dashboard has many panels which are being selected by a single time picker. Now, your problem is whatever value the time picker chooses , say 1 hr or 2 hr or 3 hr. it should apply to all the panels except the single value panel where we need to apply double the time to have a consistent view.
So for example if I choose 1 hr from the time picker it should apply to the rest of the panels but the single value panel should actually be based on 2 hours to be consistent with the rest of the panels?
Am I getting this right?

Re: How can I set time in a single value panel while respecting delta time?

gcusello — Tue, 19 Sep 2017 10:58:01 GMT

Yes!
I tried with double time period but I failed, and I tried with timewrap but I failed again.
So I'm not using trends in single value panels but I'd like to use them.
Bye.
Giuseppe

Re: How can I set time in a single value panel while respecting delta time?

Sukisen1981 — Tue, 19 Sep 2017 13:39:41 GMT

just one more question - the time picker is set as what?
earliest , latest , preset, relative or what is the form of the time picker?

Re: How can I set time in a single value panel while respecting delta time?

gcusello — Tue, 19 Sep 2017 13:44:52 GMT

it's the defaut time picker with earliest and latest.
Bye.
Giuseppe

Re: How can I set time in a single value panel while respecting delta time?

alemarzu — Tue, 19 Sep 2017 15:48:22 GMT

Hi there @cusello

Have you seen this answer from @MuS ♦

https://answers.splunk.com/answers/390574/how-to-create-a-search-that-shows-a-trending-value.html

Re: How can I set time in a single value panel while respecting delta time?

gcusello — Fri, 22 Sep 2017 08:15:58 GMT

Hi alemarzu,
this solution is really near to my needs because it runs but only for time periods that end with now(), if I use e.g. yesterday as time period it doesn't run.
I tried to use the same logic to modify the search but it not runs, can you help me?
Thank you.
Bye.
Giuseppe