topic Re: How to display two result count in value visualization in Splunk Search

How to display two result count in value visualization?

Roberto-P — Fri, 28 Apr 2023 13:07:11 GMT

Hi community,

I have the follow search that return two number for today and yesterday device count per index xyz but i'm not able to visualize both them as show below the "today" is missing

This is the search:

Could you please help me to understand how to have a result like this indication today vs yesterday?

Thank you

Roby

Re: How to display two result count in value visualization

rut — Thu, 27 Apr 2023 19:06:21 GMT

Hi @Roberto-P, I think changing the range from 2 days ago to now, combined with "by _time span=1d" would be enough to get your results in a single search. The addition of the grouped _time field would ensure the visualization can compare it's value to the previous value:

| tstats dc(host) as hosts, where index=*01* by _time span=1d

Under format visualization (the brush), you should set the following settings to remove the sparkline and display the percentage:

Re: How to display two result count in value visualization

richgalloway — Thu, 27 Apr 2023 19:40:18 GMT

The SingleValue visualization displays one value. If the results are from the timechart command then the SV also can show a sparkline of previous values and the difference between the current value and the previous one. There is no provision for displaying 2 values.

Re: How to display two result count in value visualization

Roberto-P — Fri, 28 Apr 2023 11:34:37 GMT

Thanks a lot Rut for the new search that solved my problem. it works great !