topic Re: Sparkline and Trend Indicator splunk in Splunk Search

Sparkline and Trend Indicator splunk

dchalasani — Thu, 18 May 2017 14:12:21 GMT

Hi,

I did Sparkline and Trend Indicator splunk as compared to lastweek.

In the result it showing as 92 means in 2 digit value only it is showing. Actually it has to show in like 9240000 like this.

Can any one please help me with this.

source code

<earliest>-7d</earliest>
      <latest>-60m@m</latest>
      <sampleRatio>1</sampleRatio>
    </search>
    <option name="trendColorInterpretation">standard</option>
    <option name="trendDisplayMode">absolute</option>
    <option name="trendInterval">-1h</option>
    <option name="colorBy">value</option>
    <option name="colorMode">none</option>
    <option name="numberPrecision">0</option>
    <option name="showTrendIndicator">1</option>
    <option name="showSparkline">1</option>
    <option name="useColors">0</option>
    <option name="useThousandSeparators">1</option>
    <option name="underLabel">Compared to lastweek</option>

Thanks

Re: Sparkline and Trend Indicator splunk

dchalasani — Tue, 29 Sep 2020 14:06:52 GMT

And I used string as

index=aws sourcetype=description earliest=-7d | stats count as alert_risk_level by _time | timechart span=60m max(alert_risk_level) | rename max(alert_risk_level) as Risk_Identified

Re: Sparkline and Trend Indicator splunk

niketn — Tue, 29 Sep 2020 14:06:58 GMT

Do you want to bucket alert_risk_level in 1 hour window? Use following query instead

index=aws sourcetype=description earliest=-7d 
| timechart span=1h count(alert_risk_level) as Risk_Identified

Re: Sparkline and Trend Indicator splunk

dchalasani — Thu, 18 May 2017 15:01:35 GMT

Thanks Nike!

Re: Sparkline and Trend Indicator splunk

niketn — Thu, 18 May 2017 15:03:36 GMT

@dchalasani, glad it worked. I have converted to answer. Please Accept Answer to close this question.

Re: Sparkline and Trend Indicator splunk

dchalasani — Thu, 18 May 2017 15:08:11 GMT

Ok...and The Trend Indicator is showing very small.. Can we make it big(Trend Indicator) to show in a effective way.

Thanks

Re: Sparkline and Trend Indicator splunk

niketn — Thu, 18 May 2017 19:58:09 GMT

All single value elements adjust according to the size of panel and amount of data. You can color your single value panel based on trends to make the same obvious. You should be able to Edit Panel and choose these settings from Format menu.