I did Sparkline and Trend Indicator splunk as compared to lastweek.
In the result it showing as 92 means in 2 digit value only it is showing. Actually it has to show in like 9240000 like this.
Can any one please help me with this.
<earliest>-7d</earliest> <latest>-60m@m</latest> <sampleRatio>1</sampleRatio> </search> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="trendInterval">-1h</option> <option name="colorBy">value</option> <option name="colorMode">none</option> <option name="numberPrecision">0</option> <option name="showTrendIndicator">1</option> <option name="showSparkline">1</option> <option name="useColors">0</option> <option name="useThousandSeparators">1</option> <option name="underLabel">Compared to lastweek</option>
And I used string as
index=aws sourcetype=description earliest=-7d | stats count as alertrisklevel by time | timechart span=60m max(alertrisklevel) | rename max(alertrisklevel) as RiskIdentified
Do you want to bucket alertrisklevel in 1 hour window? Use following query instead
index=aws sourcetype=description earliest=-7d | timechart span=1h count(alert_risk_level) as Risk_Identified
Ok...and The Trend Indicator is showing very small.. Can we make it big(Trend Indicator) to show in a effective way.
All single value elements adjust according to the size of panel and amount of data. You can color your single value panel based on trends to make the same obvious. You should be able to Edit Panel and choose these settings from Format menu.