Dashboards & Visualizations

How can I set time in a single value panel while respecting delta time?

gcusello
SplunkTrust
SplunkTrust

Hi at all,
I'd like to show trends in Single Value panels.
Following the example in Splunk 6.x dashboard Examples App, I used a timechart command

my_search
| timechart count bins=2

but the problem is that in this way I give an information different from all the other panels in my dashboard, because, setting last hour in the Time Picker, I show events in the last hour in all the panels and events in the last half hour in Single Value Panels!
What is the best way to proceed: set a double time in Single Value Panels or Timewrap or another solution?

How can I set double time in the Single Value panels?
I tried also with Timewrap command but in this command I cannot manage delta time.

Has someone any idea how to solve this problem?

Thank you in advance.
Bye.
Giuseppe

0 Karma

alemarzu
Motivator

gcusello
SplunkTrust
SplunkTrust

Hi alemarzu,
this solution is really near to my needs because it runs but only for time periods that end with now(), if I use e.g. yesterday as time period it doesn't run.
I tried to use the same logic to modify the search but it not runs, can you help me?
Thank you.
Bye.
Giuseppe

0 Karma

Sukisen1981
Champion

Something like this ?
earliest=-2h
| timechart count bins=2 | reverse | head 2 | reverse

this gives me a single value hourly trend

0 Karma

gcusello
SplunkTrust
SplunkTrust

Thank you Sukisen1981,
the problem is that in my dashboard I need the Time Picket to set the Time in the dashboard.
So if I set 2 hours in the Time Picker, the other panels show events of 2 hours and Single Value panels show events of 1 hour, this solution doesn't solve my problem: the time picker.
Thank you.
Bye.
Giuseppe

0 Karma

Sukisen1981
Champion

hmm so your dashboard has many panels which are being selected by a single time picker. Now, your problem is whatever value the time picker chooses , say 1 hr or 2 hr or 3 hr. it should apply to all the panels except the single value panel where we need to apply double the time to have a consistent view.
So for example if I choose 1 hr from the time picker it should apply to the rest of the panels but the single value panel should actually be based on 2 hours to be consistent with the rest of the panels?
Am I getting this right?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Yes!
I tried with double time period but I failed, and I tried with timewrap but I failed again.
So I'm not using trends in single value panels but I'd like to use them.
Bye.
Giuseppe

0 Karma

Sukisen1981
Champion

just one more question - the time picker is set as what?
earliest , latest , preset, relative or what is the form of the time picker?

0 Karma

gcusello
SplunkTrust
SplunkTrust

it's the defaut time picker with earliest and latest.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...