Use case: looking to create a dashboard with a single value panel that shows major value and trend value for tps by severity. However attempts with current queries aren't successful.
Example. Running a query like:
index="soar" Severity="Sev1"
| stats count
will show the accurate value, but to show the trend value it needs to be timechart, however when running query
index="soar" Severity="Sev1"
| timechart count as sev4
i get a 0 value for both major and trend value. In these cases we are using the global time range. Environment is Splunk Cloud and the dashboards are in dashboard studio.
the stats query works in both search and in the dash. Only issue is with the timechart. No matter the approach it shows 0 for both major and trend value. But outside dashboard it does work, but not inside.
the time picker is set by default for last 7 days. the domain reference is default so global.time.earliest - global.time.latest.
You will get a zero if the last value is zero. Make sure the last value in your time range has a value. Check a table view of your results.
index="soar" Severity="Sev4"
| timechart count as sev_4
the table view of this query is providing results. I am looking at past 7 days, there are 3 events spread over the 7-day period. Also, the last value in the search is a 1.
Sounds like your data has no recent events. Try changing your timeframe to complete earlier.