How to set a single value result to show the Total and have a sparkline showing the trending average underneath?

[antonyhan]

To my understanding, single value uses the first value of the result table.
However, how do I build the search for the single value panel to show the total and sparkline underneath to show average?
Also, how do I change the trend indicator to compare current total and total an hour ago?

[jluo_splunk]

If you'd like to see the total as the "main" single value, you'll have to forfeit the use of timechart (since this will be time-based), which will then forfeit the sparkline and trend indicator. I think you best bet may be to separate this into two different single value visualizations. One single value visualization for the running total, and a separate one where you show the 15 min average, which will can include the trend from an hour ago.

[antonyhan]

What I hope to achieve is to have the 68 represents the running TOTAL, -135 is the trend from an hour ago and the sparkline shows the 15 minutes average.
Right now I can only show the last 15 mins' avg where the [68] is.

thanks.

[zeinstein]

I'm trying to achieve something very similar (without the trend part). I can show the total using addcoltotals, however, then the sparkline is messed up. Then, when I have a nice sparkline, then the total is nowhere to be shown... Did you come to a solution on this matter?