Dashboards & Visualizations

How do you make a single value panel with spark and trend line with this data?

UMDTERPS
Communicator

 

 

| inputlookup system_trending.csv

| search system = "bob"
|table date “System Score)

| fieldformat date = strftime(date, "%m/%d/%Y")

 


The above search creates the following statistics table for a selected system named “Bob”:

 

date                       Score          
05/20/2020                  10
06/20/2020                  12
07/20/2020                  10           
08/20/2020                  20

 


How do I make this into a single value panel with spark and trend line? If I just select the single value panel from the visualizations it just shows the date of “05/20/2020.”  If I use "| timechart max(date)"  I get 0 results. 


Any ideas?  😀

Thanks!

0 Karma
1 Solution

to4kawa
Ultra Champion

sample:

| makeresults
| eval _raw="date                       Score          
05/20/2020                  10
06/20/2020                  12
07/20/2020                  10           
08/20/2020                  20"
| multikv forceheader=1
| eval date=strptime(date,"%m/%d/%Y")
| table date Score
| rename date as _time

 

recommend:

| inputlookup system_trending.csv where system="bob"
| rename date as _time
| table _time Score

 

View solution in original post

to4kawa
Ultra Champion

sample:

| makeresults
| eval _raw="date                       Score          
05/20/2020                  10
06/20/2020                  12
07/20/2020                  10           
08/20/2020                  20"
| multikv forceheader=1
| eval date=strptime(date,"%m/%d/%Y")
| table date Score
| rename date as _time

 

recommend:

| inputlookup system_trending.csv where system="bob"
| rename date as _time
| table _time Score

 

UMDTERPS
Communicator

That works! 👍 Didn't know it would be that easy! 😀

 

Is there a way to prevent the number from rounding?

Tags (1)
0 Karma

to4kawa
Ultra Champion

>Is there a way to prevent the number from rounding?
which number?

how about modifying "Format > Number Format > Precision"

UMDTERPS
Communicator

Works! 😀

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...