Dashboards & Visualizations

Single value major and trend value showing as 0.

DBbd
Observer

Use case: looking to create a dashboard with a single value panel that shows major value and trend value for tps by severity. However attempts with current queries aren't successful.
Example. Running a query like:
index="soar" Severity="Sev1"
| stats count
will show the accurate value, but to show the trend value it needs to be timechart, however when running query
index="soar" Severity="Sev1"
| timechart count as sev4
i get a 0 value for both major and trend value. In these cases we are using the global time range. Environment is Splunk Cloud and the dashboards are in dashboard studio.

the stats query works in both search and in the dash. Only issue is with the timechart. No matter the approach it shows 0 for both major and trend value. But outside dashboard it does work, but not inside.

the time picker is set by default for last 7 days. the domain reference is default so global.time.earliest - global.time.latest.

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You will get a zero if the last value is zero. Make sure the last value in your time range has a value. Check a table view of your results.

0 Karma

DBbd
Observer

index="soar" Severity="Sev4"
| timechart count as sev_4

the table view of this query is providing results. I am looking at past 7 days, there are 3 events spread over the 7-day period. Also, the last value in the search is a 1. 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Sounds like your data has no recent events. Try changing your timeframe to complete earlier.

0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...