Single value visualisation and trend value

smacphillamy — Tue, 31 Jan 2017 22:59:21 GMT

I have db queries running every 5 minutes each logging a record of multiple fields and values. I have the following single value panel defined:

      <single>
        <title>Entered</title>
        <search>
          <query>index=db_index| regex source="db_prod/.*entered.*" | timechart span=5m dc(id)</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <refresh>3m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="colorBy">trend</option>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="refresh.time.visible">1</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="trendInterval">-1h</option>
        <option name="underLabel">Compared to Previous Hour</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>

Looking at the values displayed in the panel, I'm having difficulty understanding how the single value and the displayed trend are being calculated. The questions I have are:

With the declared search and associated parameters which data point/points are picked to compute the single value?
Which data points are used to compute the trend value?

Re: Single value visualisation and trend value

DalJeanis — Wed, 01 Feb 2017 02:02:11 GMT

The search is returning the distinct count of ids - dc(id) - in each 5 minute period - span=5m.

The trend will be displayed as the number itself rather than percentage (absolute) , with up trends being colored as good (standard) and the prior point in the trend being the point 1 hour previously.

Here's a good example by kkrdo, complete with a test data generator you can play with. After you play around a bit, you can then port the knowledge back to your real data -

https://answers.splunk.com/answers/330293/compare-option-in-single-value-in-splunk-63.html

If you find his example helps you, then please upvote him.

topic Single value visualisation and trend value in Splunk Search

Single value visualisation and trend value

Re: Single value visualisation and trend value