https://community.splunk.com/t5/Splunk-Search/Why-is-my-single-visualization-w-trendline-total-display-off-by/m-p/420346#M120832 <P>i have the following query and the events/results show "5" but the Single w/Trendline Visualization shows "4".</P> <PRE><CODE>index=logs source="*tst*" | search ("Attempt" AND "status=SUCCESS") | timechart count as Total </CODE></PRE> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/6430iC48E4070A71A8A2D/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 22 Jan 2019 03:08:57 GMT jaj 2019-01-22T03:08:57Z https://community.splunk.com/t5/Splunk-Search/Why-is-my-single-visualization-w-trendline-total-display-off-by/m-p/420346#M120832 <P>i have the following query and the events/results show "5" but the Single w/Trendline Visualization shows "4".</P> <PRE><CODE>index=logs source="*tst*" | search ("Attempt" AND "status=SUCCESS") | timechart count as Total </CODE></PRE> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/6430iC48E4070A71A8A2D/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 22 Jan 2019 03:08:57 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-my-single-visualization-w-trendline-total-display-off-by/m-p/420346#M120832 jaj 2019-01-22T03:08:57Z https://community.splunk.com/t5/Splunk-Search/Why-is-my-single-visualization-w-trendline-total-display-off-by/m-p/420347#M120833 <P>@jaj you should try to understand how single value trendline works first.</P> <P>By default the trendline result is the lastest value and the trend value is the difference of latest compared to the penultimate number i.e. comparison of last value with second last.</P> <P>As per your example single value result is 4 (on 01/21) and trend value is 4-0 (0 on 1/20). The same is also highlighted in trendline as last two data point being of bold black color.</P> <P>PS: You can change the default <CODE>Compare to</CODE> option using UI &gt; Edit &gt; Format Visualization or Simple XML.</P> <P>However in case you need to compare/built trendline with non zero values you have two options</P> <P>1) use <CODE>timechart</CODE> with <CODE>cont=f</CODE> which shows only non zero values in the timechart and also breaks the continuity of the chart.</P> <P>2) use command <CODE>| filldown</CODE> which fills null values as previous not null value. Since count fills each time bucket with 0 you may have to tweak the query before using fillnull.</P> Tue, 22 Jan 2019 03:42:55 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-my-single-visualization-w-trendline-total-display-off-by/m-p/420347#M120833 niketn 2019-01-22T03:42:55Z https://community.splunk.com/t5/Splunk-Search/Why-is-my-single-visualization-w-trendline-total-display-off-by/m-p/420348#M120834 <P>@niketnilay thanks for the response and explanation.</P> Tue, 22 Jan 2019 21:19:00 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-my-single-visualization-w-trendline-total-display-off-by/m-p/420348#M120834 jaj 2019-01-22T21:19:00Z