How to create a panel with a single value and trend that changes based on selected time range picker values?

[stevejfice]

Hi all,

I have a panel in a dashboard that loads a simple count of a certain search (number of unique hosts in a series of .json files), and the whole dashboard is controlled by a central time picker. I'd like to be able to show how the trend of number of hosts reported has changed if I change the value in the time picker.

EG: If I choose last 24 hours, it shows the single value as the last 24 hours, but should also have a trend of the previous 24 hours. If I then change that to 7 days, the single value will update and the trend will be the previous 7 days.

I've tried several attempts based on other questions posted and their answers as well as third party blogs, but have found nothing concrete. Also, reflecting items in the Sample Dashboards app hasn't led me anywhere.

Latest version of Splunk, btw.

[sundareshr · Accepted solution]

See if this gives you any idea. Below is a run anywhere sample

<form>
  <label>Test Dashboard</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="f1" searchWhenChanged="true">
      <label>field1</label>
      <choice value="-48h@h">Last 24 Hours</choice>
      <choice value="-7d@d">Last 7 days</choice>
      <change>
        <condition label="Last 24 Hours">
          <set token="a">$value$</set>
          <unset token="b"></unset>
        </condition>
        <condition label="Last 7 days">
          <set token="b">$value$</set>
          <unset token="a"></unset>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$a$">
      <single>
        <search>
          <query>index=_internal sourcetype="splunk*" earliest="$a$" | timechart span=24h count</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">undefined</option>
        <option name="rowNumbers">undefined</option>
        <option name="drilldown">none</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">10</option>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="numberPrecision">0</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <option name="linkView">search</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
      </single>
    </panel>
    <panel depends="$b$">
      <single>
        <search>
          <query>index=_internal sourcetype="splunk*" earliest="$b$" | timechart span=7d count</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">undefined</option>
        <option name="rowNumbers">undefined</option>
        <option name="drilldown">none</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">10</option>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="numberPrecision">0</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <option name="linkView">search</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
      </single>
    </panel>
  </row>
</form>

[stevejfice]

That is a fantastic start and a huge help, thank you very much.

I need to go away for a while and figure out how to manipulate the searching I'm doing to achieve the outputs I want (I'm just doing a stats dc() as the output for a single value which won't work here for the span)