Hi at all,
I'd like to show trends in Single Value panels.
Following the example in Splunk 6.x dashboard Examples App, I used a timechart command
my_search | timechart count bins=2
but the problem is that in this way I give an information different from all the other panels in my dashboard, because, setting last hour in the Time Picker, I show events in the last hour in all the panels and events in the last half hour in Single Value Panels!
What is the best way to proceed: set a double time in Single Value Panels or Timewrap or another solution?
How can I set double time in the Single Value panels?
I tried also with Timewrap command but in this command I cannot manage delta time.
Has someone any idea how to solve this problem?
Thank you in advance.
Something like this ?
| timechart count bins=2 | reverse | head 2 | reverse
this gives me a single value hourly trend
Thank you Sukisen1981,
the problem is that in my dashboard I need the Time Picket to set the Time in the dashboard.
So if I set 2 hours in the Time Picker, the other panels show events of 2 hours and Single Value panels show events of 1 hour, this solution doesn't solve my problem: the time picker.
hmm so your dashboard has many panels which are being selected by a single time picker. Now, your problem is whatever value the time picker chooses , say 1 hr or 2 hr or 3 hr. it should apply to all the panels except the single value panel where we need to apply double the time to have a consistent view.
So for example if I choose 1 hr from the time picker it should apply to the rest of the panels but the single value panel should actually be based on 2 hours to be consistent with the rest of the panels?
Am I getting this right?
I tried with double time period but I failed, and I tried with timewrap but I failed again.
So I'm not using trends in single value panels but I'd like to use them.
just one more question - the time picker is set as what?
earliest , latest , preset, relative or what is the form of the time picker?
this solution is really near to my needs because it runs but only for time periods that end with now(), if I use e.g. yesterday as time period it doesn't run.
I tried to use the same logic to modify the search but it not runs, can you help me?