<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Single Value Panel on absolute metric resets to 0 in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Single-Value-Panel-on-absolute-metric-resets-to-0/m-p/480151#M31471</link>
    <description>&lt;P&gt;@sadohert - if your problem is solved, please accept the solution.  Thanks!&lt;/P&gt;</description>
    <pubDate>Tue, 28 Apr 2020 16:04:25 GMT</pubDate>
    <dc:creator>DalJeanis</dc:creator>
    <dc:date>2020-04-28T16:04:25Z</dc:date>
    <item>
      <title>Single Value Panel on absolute metric resets to 0</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Single-Value-Panel-on-absolute-metric-resets-to-0/m-p/480148#M31468</link>
      <description>&lt;P&gt;Apologies in advance if I'm mixing some terminology.  I'm relatively new to Splunk.&lt;/P&gt;

&lt;P&gt;I'm building a Splunk app to monitor our product, &lt;A href="https://mattermost.com/"&gt;Mattermost&lt;/A&gt;.  We expose Prometheus style metrics and I'm using &lt;A href="https://github.com/lukemonahan/splunk_modinput_prometheus"&gt;this Prometheus data input type&lt;/A&gt; by @&lt;A href="mailto:luke.monahan@rivium.com.au"&gt;luke.monahan@rivium.com.au&lt;/A&gt;  to get the metrics in (thanks Luke!).&lt;/P&gt;

&lt;P&gt;We have a metric &lt;CODE&gt;mattermost_db_master_connections_total&lt;/CODE&gt; that is displayed in a Single Value chart at the top of a dashboard, as well as in amongst some time series charts below.  The time series chart seems to match with what I see in our equivalent Grafana dashboard, but the Single Value stat seems to bounce between &lt;CODE&gt;0&lt;/CODE&gt; and the value I would expect, depending on the timing of when I refresh the dashboard.&lt;/P&gt;

&lt;P&gt;Is there something I should be doing in my query to smooth out those drops to &lt;CODE&gt;0&lt;/CODE&gt; on the single value panel?  What is happening here?  Missing values I don't see on the time series?&lt;/P&gt;

&lt;P&gt;Single Value Query:&lt;BR /&gt;
&lt;CODE&gt;&lt;BR /&gt;
| mstats max(_value) prestats=true WHERE metric_name="mattermost_db_master_connections_total" AND sourcetype=prometheus:metric  span=15s&lt;BR /&gt;
| timechart max(_value) span=15s&lt;BR /&gt;
&lt;/CODE&gt;&lt;/P&gt;

&lt;P&gt;Time Series Query:&lt;BR /&gt;
&lt;CODE&gt;| mstats max(_value) prestats=true WHERE metric_name="mattermost_db_master_connections_total" AND sourcetype=prometheus:metric  span=15s BY host&lt;BR /&gt;
| timechart max(_value) span=15s agg=max useother=false BY host&lt;BR /&gt;
| addtotals&lt;BR /&gt;
&lt;/CODE&gt;&lt;/P&gt;

&lt;P&gt;Screenshots:&lt;BR /&gt;
Single Value (after refreshing... and seemingly majority of the time it looks like this... every few refreshes I'll get &lt;CODE&gt;3&lt;/CODE&gt; as expected):&lt;BR /&gt;
&lt;span class="lia-inline-image-display-wrapper" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/8735i1AE854DFFA14E6B8/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;

&lt;P&gt;Time Series Plot:&lt;BR /&gt;
&lt;span class="lia-inline-image-display-wrapper" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/8736iCA272C392043D36A/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Fri, 17 Apr 2020 11:16:04 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Single-Value-Panel-on-absolute-metric-resets-to-0/m-p/480148#M31468</guid>
      <dc:creator>sadohert</dc:creator>
      <dc:date>2020-04-17T11:16:04Z</dc:date>
    </item>
    <item>
      <title>Re: Single Value Panel on absolute metric resets to 0</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Single-Value-Panel-on-absolute-metric-resets-to-0/m-p/480149#M31469</link>
      <description>&lt;P&gt;&lt;CODE&gt;smooth out those drops to 0&lt;/CODE&gt;&lt;BR /&gt;
If there is no data at 15 second intervals, &lt;CODE&gt;0&lt;/CODE&gt; is displayed.&lt;BR /&gt;
What should it do?&lt;BR /&gt;
Why don't you try to expand time span?&lt;/P&gt;</description>
      <pubDate>Fri, 17 Apr 2020 22:26:02 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Single-Value-Panel-on-absolute-metric-resets-to-0/m-p/480149#M31469</guid>
      <dc:creator>to4kawa</dc:creator>
      <dc:date>2020-04-17T22:26:02Z</dc:date>
    </item>
    <item>
      <title>Re: Single Value Panel on absolute metric resets to 0</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Single-Value-Panel-on-absolute-metric-resets-to-0/m-p/480150#M31470</link>
      <description>&lt;P&gt;Thanks for weighing in.  I increased the span and this appears to have resolved the drops to &lt;CODE&gt;0&lt;/CODE&gt;.&lt;/P&gt;</description>
      <pubDate>Tue, 28 Apr 2020 10:26:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Single-Value-Panel-on-absolute-metric-resets-to-0/m-p/480150#M31470</guid>
      <dc:creator>sadohert</dc:creator>
      <dc:date>2020-04-28T10:26:32Z</dc:date>
    </item>
    <item>
      <title>Re: Single Value Panel on absolute metric resets to 0</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Single-Value-Panel-on-absolute-metric-resets-to-0/m-p/480151#M31471</link>
      <description>&lt;P&gt;@sadohert - if your problem is solved, please accept the solution.  Thanks!&lt;/P&gt;</description>
      <pubDate>Tue, 28 Apr 2020 16:04:25 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Single-Value-Panel-on-absolute-metric-resets-to-0/m-p/480151#M31471</guid>
      <dc:creator>DalJeanis</dc:creator>
      <dc:date>2020-04-28T16:04:25Z</dc:date>
    </item>
    <item>
      <title>Re: Single Value Panel on absolute metric resets to 0</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Single-Value-Panel-on-absolute-metric-resets-to-0/m-p/480152#M31472</link>
      <description>&lt;P&gt;Thanks.  I was looking for a way to do this earlier today, but didn't see the button.  Done&lt;/P&gt;</description>
      <pubDate>Tue, 28 Apr 2020 16:13:11 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Single-Value-Panel-on-absolute-metric-resets-to-0/m-p/480152#M31472</guid>
      <dc:creator>sadohert</dc:creator>
      <dc:date>2020-04-28T16:13:11Z</dc:date>
    </item>
  </channel>
</rss>

