Archive
Highlighted

Sparkline and Trend Indicator splunk

Path Finder

Hi,

I did Sparkline and Trend Indicator splunk as compared to lastweek.

In the result it showing as 92 means in 2 digit value only it is showing. Actually it has to show in like 9240000 like this.

Can any one please help me with this.

source code

<earliest>-7d</earliest>
      <latest>-60m@m</latest>
      <sampleRatio>1</sampleRatio>
    </search>
    <option name="trendColorInterpretation">standard</option>
    <option name="trendDisplayMode">absolute</option>
    <option name="trendInterval">-1h</option>
    <option name="colorBy">value</option>
    <option name="colorMode">none</option>
    <option name="numberPrecision">0</option>
    <option name="showTrendIndicator">1</option>
    <option name="showSparkline">1</option>
    <option name="useColors">0</option>
    <option name="useThousandSeparators">1</option>
    <option name="underLabel">Compared to lastweek</option>

Thanks

0 Karma
Highlighted

Re: Sparkline and Trend Indicator splunk

Path Finder

And I used string as

index=aws sourcetype=description earliest=-7d | stats count as alertrisklevel by time | timechart span=60m max(alertrisklevel) | rename max(alertrisklevel) as RiskIdentified

0 Karma
Highlighted

Re: Sparkline and Trend Indicator splunk

Legend

Do you want to bucket alertrisklevel in 1 hour window? Use following query instead

index=aws sourcetype=description earliest=-7d 
| timechart span=1h count(alert_risk_level) as Risk_Identified

View solution in original post

0 Karma
Highlighted

Re: Sparkline and Trend Indicator splunk

Path Finder

Thanks Nike!

0 Karma
Highlighted

Re: Sparkline and Trend Indicator splunk

Legend

@dchalasani, glad it worked. I have converted to answer. Please Accept Answer to close this question.

0 Karma
Highlighted

Re: Sparkline and Trend Indicator splunk

Path Finder

Ok...and The Trend Indicator is showing very small.. Can we make it big(Trend Indicator) to show in a effective way.

Thanks

0 Karma
Highlighted

Re: Sparkline and Trend Indicator splunk

Legend

All single value elements adjust according to the size of panel and amount of data. You can color your single value panel based on trends to make the same obvious. You should be able to Edit Panel and choose these settings from Format menu.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.