Dashboards & Visualizations

How to set a single value result to show the Total and have a sparkline showing the trending average underneath?

antonyhan
Path Finder

To my understanding, single value uses the first value of the result table.
However, how do I build the search for the single value panel to show the total and sparkline underneath to show average?
Also, how do I change the trend indicator to compare current total and total an hour ago?

jluo_splunk
Splunk Employee
Splunk Employee

If you'd like to see the total as the "main" single value, you'll have to forfeit the use of timechart (since this will be time-based), which will then forfeit the sparkline and trend indicator. I think you best bet may be to separate this into two different single value visualizations. One single value visualization for the running total, and a separate one where you show the 15 min average, which will can include the trend from an hour ago.

antonyhan
Path Finder

alt text

What I hope to achieve is to have the 68 represents the running TOTAL, -135 is the trend from an hour ago and the sparkline shows the 15 minutes average.
Right now I can only show the last 15 mins' avg where the [68] is.

thanks.

0 Karma

zeinstein
Path Finder

I'm trying to achieve something very similar (without the trend part). I can show the total using addcoltotals, however, then the sparkline is messed up. Then, when I have a nice sparkline, then the total is nowhere to be shown... Did you come to a solution on this matter?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!