How to get a dashboard single value visualisation to show how data is trending from the previous week?

[lmaclean]

I have a dashboard on weekly bandwidth usage, and would like to get trending on the multiple reports that use the Single Value Visualisation to show if it was up/down from the previous week. However, not sure which command I should be using. One of my searches as an example is for avg. bandwidth per users:

... | stats sum(bandwidth_total) as Bandwidth by user
| stats avg(Bandwidth) as Bandwidth
| eval Bandwidth = tostring(Bandwidth,"commas")

Time range: Previous Week

I know the Enterprise Security app has an arrow for trending for real-time/historic data, but how do I do this in the normal search app?

[MuS]

Hi lmaclean,

download the dashboard example app https://splunkbase.splunk.com/app/1603/ and check out the dashboard /en-US/app/simple_xml_examples/simple_single or /en-US/app/simple_xml_examples/simple_single_color to see how this is done.

Hope this helps ...

cheers, MuS

[MuS]

The later one is only for Splunk 6.3 available, the former started at Splunk 6.0