Dashboards & Visualizations
Highlighted

How can I set time in a single value panel while respecting delta time?

Legend

Hi at all,
I'd like to show trends in Single Value panels.
Following the example in Splunk 6.x dashboard Examples App, I used a timechart command

my_search
| timechart count bins=2

but the problem is that in this way I give an information different from all the other panels in my dashboard, because, setting last hour in the Time Picker, I show events in the last hour in all the panels and events in the last half hour in Single Value Panels!
What is the best way to proceed: set a double time in Single Value Panels or Timewrap or another solution?

How can I set double time in the Single Value panels?
I tried also with Timewrap command but in this command I cannot manage delta time.

Has someone any idea how to solve this problem?

Thank you in advance.
Bye.
Giuseppe

0 Karma
Highlighted

Re: How can I set time in a single value panel while respecting delta time?

Champion

Something like this ?
earliest=-2h
| timechart count bins=2 | reverse | head 2 | reverse

this gives me a single value hourly trend

0 Karma
Highlighted

Re: How can I set time in a single value panel while respecting delta time?

Legend

Thank you Sukisen1981,
the problem is that in my dashboard I need the Time Picket to set the Time in the dashboard.
So if I set 2 hours in the Time Picker, the other panels show events of 2 hours and Single Value panels show events of 1 hour, this solution doesn't solve my problem: the time picker.
Thank you.
Bye.
Giuseppe

0 Karma
Highlighted

Re: How can I set time in a single value panel while respecting delta time?

Champion

hmm so your dashboard has many panels which are being selected by a single time picker. Now, your problem is whatever value the time picker chooses , say 1 hr or 2 hr or 3 hr. it should apply to all the panels except the single value panel where we need to apply double the time to have a consistent view.
So for example if I choose 1 hr from the time picker it should apply to the rest of the panels but the single value panel should actually be based on 2 hours to be consistent with the rest of the panels?
Am I getting this right?

0 Karma
Highlighted

Re: How can I set time in a single value panel while respecting delta time?

Legend

Yes!
I tried with double time period but I failed, and I tried with timewrap but I failed again.
So I'm not using trends in single value panels but I'd like to use them.
Bye.
Giuseppe

0 Karma
Highlighted

Re: How can I set time in a single value panel while respecting delta time?

Champion

just one more question - the time picker is set as what?
earliest , latest , preset, relative or what is the form of the time picker?

0 Karma
Highlighted

Re: How can I set time in a single value panel while respecting delta time?

Legend

it's the defaut time picker with earliest and latest.
Bye.
Giuseppe

0 Karma
Highlighted

Re: How can I set time in a single value panel while respecting delta time?

Motivator
Highlighted

Re: How can I set time in a single value panel while respecting delta time?

Legend

Hi alemarzu,
this solution is really near to my needs because it runs but only for time periods that end with now(), if I use e.g. yesterday as time period it doesn't run.
I tried to use the same logic to modify the search but it not runs, can you help me?
Thank you.
Bye.
Giuseppe

0 Karma