topic Re: How to create a single value trend to show the difference based on the previous day? in Splunk Search

How to create a single value trend to show the difference based on the previous day?

seetharamanss — Fri, 22 Jul 2016 20:56:57 GMT

Hi ,

I need to create a single value visualization with the trend indicator. The trend indicator should be the difference based on the previous day difference. Below is the search and the response from the search But when it calculates the trend, it's taking percentage change ie, (80-20)/20 *100% = 300% instead of simply giving the difference as it is already in % (80%-20%)= +60% .

Please advise if I'm missing out something here.

day     FILLCNT     tempcount   FILRATE     totalcount
20    1        1746         80          2193
19    1        447        20          2193

      <query> sourcetype=mysourcetype  | eval  day = strftime(strptime(Timestamp,"%Y-%m-%d-%H.%M.%S.%6N"),"%d") | eval FILLCNT =if((myfillfield = "Y"),1,0)|  stats count as tempcount by day,FILLCNT| eventstats sum(tempcount) as totalcount by cur |eval FILRATE = round((tempcount /totalcount) * 100,0) |sort -FILLCNT -day </query> 
      <earliest>-2d</earliest>
      <latest>now</latest>
    </search> 
   60
    <option name="field">FILRATE</option>
    <option name="afterLabel">%</option>
    <option name="colorBy">value</option>
    <option name="colorMode">none</option>
    <option name="unitPosition">after</option>
    <option name="numberPrecision">0</option>
    <option name="showSparkline">true</option>
    <option name="showTrendIndicator">true</option>
    <option name="trendColorInterpretation">standard</option>
    <option name="trendDisplayMode">percent</option>
    <option name="useColors">1</option>
    <option name="useThousandSeparators">true</option>
    <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0x65a637","0x65a637"]       </option>
    <option name="rangeValues">[0,30,80,90]</option>
    <option name="linkView">search</option>
    <option name="drilldown">none</option>

Re: How to create a single value trend to show the difference based on the previous day?

sundareshr — Fri, 22 Jul 2016 22:01:55 GMT

Change the trendDisplayMode to standard from percent.

<option name="trendDisplayMode">absolute</option>

Re: How to create a single value trend to show the difference based on the previous day?

seetharamanss — Fri, 22 Jul 2016 22:23:24 GMT

Hi,
I tried it . Still have the same problem.

Re: How to create a single value trend to show the difference based on the previous day?

sundareshr — Fri, 22 Jul 2016 23:03:51 GMT

Try this.

<single>
<search>
<query>sourcetype=mysourcetype earliest=-2d@d | eval day=strptime(Timestamp,"%Y-%m-%d-%H.%M.%S.%6N") | eval FILLCNT=if((myfillfield = "Y"),1,0) | bin span=1d day | stats count as tempcount count(eval(mygillfield="Y")) as FILLCNT by day | eventstats sum(tempcount) as totalcount | eval FILRATE=round((tempcount/totalcount) * 100,0) | fields day FILRATE</query>
     <earliest>-2d</earliest>
<latest></latest>
</search>
        <option name="drilldown">none</option>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="showSparkline">0</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
</single>

Re: How to create a single value trend to show the difference based on the previous day?

colinmchugo — Wed, 12 Jul 2017 15:48:29 GMT

Hi lads, i am having a similar issue. I have multple panels just doing a stats count to see the number of events. But i want to be able to compare those events for the previous 24 hours and only weekdays. Is there anyway you could assist? thanks C.