Dashboards & Visualizations

How do you make a single value panel with spark and trend line with this data?

UMDTERPS
Communicator

 

 

| inputlookup system_trending.csv

| search system = "bob"
|table date “System Score)

| fieldformat date = strftime(date, "%m/%d/%Y")

 


The above search creates the following statistics table for a selected system named “Bob”:

 

date                       Score          
05/20/2020                  10
06/20/2020                  12
07/20/2020                  10           
08/20/2020                  20

 


How do I make this into a single value panel with spark and trend line? If I just select the single value panel from the visualizations it just shows the date of “05/20/2020.”  If I use "| timechart max(date)"  I get 0 results. 


Any ideas?  😀

Thanks!

0 Karma
1 Solution

to4kawa
Ultra Champion

sample:

| makeresults
| eval _raw="date                       Score          
05/20/2020                  10
06/20/2020                  12
07/20/2020                  10           
08/20/2020                  20"
| multikv forceheader=1
| eval date=strptime(date,"%m/%d/%Y")
| table date Score
| rename date as _time

 

recommend:

| inputlookup system_trending.csv where system="bob"
| rename date as _time
| table _time Score

 

View solution in original post

to4kawa
Ultra Champion

sample:

| makeresults
| eval _raw="date                       Score          
05/20/2020                  10
06/20/2020                  12
07/20/2020                  10           
08/20/2020                  20"
| multikv forceheader=1
| eval date=strptime(date,"%m/%d/%Y")
| table date Score
| rename date as _time

 

recommend:

| inputlookup system_trending.csv where system="bob"
| rename date as _time
| table _time Score

 

UMDTERPS
Communicator

That works! 👍 Didn't know it would be that easy! 😀

 

Is there a way to prevent the number from rounding?

Tags (1)
0 Karma

to4kawa
Ultra Champion

>Is there a way to prevent the number from rounding?
which number?

how about modifying "Format > Number Format > Precision"

UMDTERPS
Communicator

Works! 😀

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...