Hi at all,
I'd like to show trends in Single Value panels.
Following the example in Splunk 6.x dashboard Examples App, I used a timechart command
my_search
| timechart count bins=2
but the problem is that in this way I give an information different from all the other panels in my dashboard, because, setting last hour in the Time Picker, I show events in the last hour in all the panels and events in the last half hour in Single Value Panels!
What is the best way to proceed: set a double time in Single Value Panels or Timewrap or another solution?
How can I set double time in the Single Value panels?
I tried also with Timewrap command but in this command I cannot manage delta time.
Has someone any idea how to solve this problem?
Thank you in advance.
Bye.
Giuseppe
Hi there @cusello
Have you seen this answer from @MuS ♦
https://answers.splunk.com/answers/390574/how-to-create-a-search-that-shows-a-trending-value.html
Hi alemarzu,
this solution is really near to my needs because it runs but only for time periods that end with now(), if I use e.g. yesterday as time period it doesn't run.
I tried to use the same logic to modify the search but it not runs, can you help me?
Thank you.
Bye.
Giuseppe
Something like this ?
earliest=-2h
| timechart count bins=2 | reverse | head 2 | reverse
this gives me a single value hourly trend
Thank you Sukisen1981,
the problem is that in my dashboard I need the Time Picket to set the Time in the dashboard.
So if I set 2 hours in the Time Picker, the other panels show events of 2 hours and Single Value panels show events of 1 hour, this solution doesn't solve my problem: the time picker.
Thank you.
Bye.
Giuseppe
hmm so your dashboard has many panels which are being selected by a single time picker. Now, your problem is whatever value the time picker chooses , say 1 hr or 2 hr or 3 hr. it should apply to all the panels except the single value panel where we need to apply double the time to have a consistent view.
So for example if I choose 1 hr from the time picker it should apply to the rest of the panels but the single value panel should actually be based on 2 hours to be consistent with the rest of the panels?
Am I getting this right?
Yes!
I tried with double time period but I failed, and I tried with timewrap but I failed again.
So I'm not using trends in single value panels but I'd like to use them.
Bye.
Giuseppe
just one more question - the time picker is set as what?
earliest , latest , preset, relative or what is the form of the time picker?
it's the defaut time picker with earliest and latest.
Bye.
Giuseppe