Dashboards & Visualizations

Cumulative count and adding the events to the results overtime

deepuhassan
Explorer

Hi

i have a requirement to create a dashboard to represent total events

i have created a panel in the dashboard which refreshes for every 5 mins.

I need to add the new results to the existing count and show it on screen

i tried using streamstats and dashboard seems freezing when it tries to refresh 

any help or advise is if great help

Thanks

Sandeep

Labels (1)
0 Karma

tscroggins
Influencer

In most cases, your search time range should accommodate this directly.

For example, to show today's current count on refresh, set the time range to earliest=@d latest=now in whichever way makes sense for your dashboard:

| tstats count where sourcetype=example earliest=@d latest=now

If your solution is more complex than that, please provide an example.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...