<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Single Value  compared with custom option in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/Single-Value-compared-with-custom-option/m-p/253197#M176481</link>
    <description>&lt;P&gt;Hi valentinv, &lt;/P&gt;

&lt;P&gt;If you want to show trend over time, you can use the timechart command in your query. For example, the following search displays product purchases over time.  &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;sourcetype=access_* action=purchase | timechart count by product 
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;So, basically you can timechart your values (each has a timestamp I presume) and visualize them using a line chart to see the trend. &lt;BR /&gt;
For more details: &lt;A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart?r=searchtip"&gt;http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart?r=searchtip&lt;/A&gt;&lt;/P&gt;

&lt;P&gt;Hope it helps. Thanks!&lt;BR /&gt;
Hunter&lt;/P&gt;</description>
    <pubDate>Thu, 13 Oct 2016 13:49:14 GMT</pubDate>
    <dc:creator>hunters_splunk</dc:creator>
    <dc:date>2016-10-13T13:49:14Z</dc:date>
    <item>
      <title>Single Value  compared with custom option</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Single-Value-compared-with-custom-option/m-p/253196#M176480</link>
      <description>&lt;P&gt;Hi!&lt;/P&gt;

&lt;P&gt;I monitor a csv file and I need to show the last value from file as Single Value chart.&lt;BR /&gt;
This last value I want to compare it with the 24 value from file and show the trend.&lt;/P&gt;

&lt;P&gt;This can be done (I guess) from query but I don't know how. Basically, Any ideas?&lt;/P&gt;

&lt;P&gt;Thank you!&lt;/P&gt;</description>
      <pubDate>Thu, 13 Oct 2016 11:43:28 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Single-Value-compared-with-custom-option/m-p/253196#M176480</guid>
      <dc:creator>valentinv</dc:creator>
      <dc:date>2016-10-13T11:43:28Z</dc:date>
    </item>
    <item>
      <title>Re: Single Value  compared with custom option</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Single-Value-compared-with-custom-option/m-p/253197#M176481</link>
      <description>&lt;P&gt;Hi valentinv, &lt;/P&gt;

&lt;P&gt;If you want to show trend over time, you can use the timechart command in your query. For example, the following search displays product purchases over time.  &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;sourcetype=access_* action=purchase | timechart count by product 
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;So, basically you can timechart your values (each has a timestamp I presume) and visualize them using a line chart to see the trend. &lt;BR /&gt;
For more details: &lt;A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart?r=searchtip"&gt;http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart?r=searchtip&lt;/A&gt;&lt;/P&gt;

&lt;P&gt;Hope it helps. Thanks!&lt;BR /&gt;
Hunter&lt;/P&gt;</description>
      <pubDate>Thu, 13 Oct 2016 13:49:14 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Single-Value-compared-with-custom-option/m-p/253197#M176481</guid>
      <dc:creator>hunters_splunk</dc:creator>
      <dc:date>2016-10-13T13:49:14Z</dc:date>
    </item>
  </channel>
</rss>

