https://community.splunk.com/t5/Dashboards-Visualizations/How-do-I-change-the-encoding-section-for-Timecharts/m-p/610631#M50063 <P>Hello everyone,&nbsp;<BR /><BR />I have been reading the documentation for timecharts however I am a bit confused on how I can modify the encoding for the timecharts to return the second column instead of the first&nbsp; as shown in the image or <A title="Splunk documentation" href="https://docs.splunk.com/Documentation/DashApp/0.9.0/DashApp/chartsSV" target="_blank" rel="noopener">here</A></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="blackcatx13_0-1661328180151.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/21162iCE173EB0690F1701/image-size/medium?v=v2&amp;px=400" role="button" title="blackcatx13_0-1661328180151.png" alt="blackcatx13_0-1661328180151.png" /><span class="lia-inline-image-caption" onclick="event.preventDefault();">blackcatx13_0-1661328180151.png</span></span></P><P><BR />I want to use a single value time chart to monitor the hosts reporting to me per hour and track the number of increase / decrease in them&nbsp;<BR /><BR />Many thanks for all your help <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span><BR /><BR /></P> Wed, 24 Aug 2022 08:05:51 GMT blackcatx13 2022-08-24T08:05:51Z https://community.splunk.com/t5/Dashboards-Visualizations/How-do-I-change-the-encoding-section-for-Timecharts/m-p/610631#M50063 <P>Hello everyone,&nbsp;<BR /><BR />I have been reading the documentation for timecharts however I am a bit confused on how I can modify the encoding for the timecharts to return the second column instead of the first&nbsp; as shown in the image or <A title="Splunk documentation" href="https://docs.splunk.com/Documentation/DashApp/0.9.0/DashApp/chartsSV" target="_blank" rel="noopener">here</A></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="blackcatx13_0-1661328180151.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/21162iCE173EB0690F1701/image-size/medium?v=v2&amp;px=400" role="button" title="blackcatx13_0-1661328180151.png" alt="blackcatx13_0-1661328180151.png" /><span class="lia-inline-image-caption" onclick="event.preventDefault();">blackcatx13_0-1661328180151.png</span></span></P><P><BR />I want to use a single value time chart to monitor the hosts reporting to me per hour and track the number of increase / decrease in them&nbsp;<BR /><BR />Many thanks for all your help <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span><BR /><BR /></P> Wed, 24 Aug 2022 08:05:51 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-do-I-change-the-encoding-section-for-Timecharts/m-p/610631#M50063 blackcatx13 2022-08-24T08:05:51Z https://community.splunk.com/t5/Dashboards-Visualizations/How-do-I-change-the-encoding-section-for-Timecharts/m-p/611015#M50091 <P>Hi</P><P>I’m not sure if I got what you are trying. Timechart with single value visualizations take always the last value (in your case count) and check what it was on previous span and then shows the trend. If you want that span is one hour then just add “timechart span=1h count” to your SPL.</P><P>r. Ismo</P> Fri, 26 Aug 2022 19:16:20 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-do-I-change-the-encoding-section-for-Timecharts/m-p/611015#M50091 isoutamo 2022-08-26T19:16:20Z