Help on Time / Chart / Span on a Single Value for a trend

[LizAndy123]

So I have a query which returns a value over a period of 7 days

The below is like the query but took a few items out

index=xxxx search xxxxx | rex field=_raw "projects/\\s*(?<ProjectID>\d+)" | rex field=_raw "HTTP\/1\.1\ (?P<Status_Code>[^\ ]*)\s*(?P<Size>\d+)\s*(?P<Speed>\d+)" | eval MB=Size/1024/1024 | eval SecTM=Speed/1000 | eval Examplefield=case(SecTM<=1.00, "90%")| stats count by Examplefield | table count

I can get the single value over 7 days

I want to be able to do like a comparaison over the previous 7 days

So lets number is 100,000 and prevous week was 90,000 then it shows up 10,000 or vice versa if that makes sense.
I have seen the Sample Dashboard with Single Value with an arrow going up or down but I just have no clue how to syntax the time bit

[richgalloway · Accepted solution]

If you want a single value display with a trend arrow then you need a timechart command in the query.

index=xxxx search xxxxx 
| rex field=_raw "projects/\\s*(?<ProjectID>\d+)" 
| rex field=_raw "HTTP\/1\.1\ (?P<Status_Code>[^\ ]*)\s*(?P<Size>\d+)\s*(?P<Speed>\d+)" 
| eval MB=Size/1024/1024 
| eval SecTM=Speed/1000 
| eval Examplefield=case(SecTM<=1.00, "90%")
| timechart span=7d count

For comparison in a table, replace the timechart command with timewrap.