how to create trend showing increase or decrease in count from yesterday to today in single value

[umsundar2015]

hi ,

my requirement is to show a single value graph with difference from yesterday scope count .the difference should be shown near the total count of today with increase or decrease symbol .

ex: 4001 then symbol with difference

please help me with it

[niketn · Accepted solution]

@umsundar2015 as stated by @kmorris_splunk you should be able to use Single Value Chart with Trending to depict such kind of data. Following is a run anywhere dashboard based on Splunk's _internal index:

Following is Simple XML code for run anywhere example in the screenshot:

<dashboard>
  <label>Trend Today Compared to Previous Day</label>
  <row>
    <panel>
      <single>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!="INFO" earliest=-1d@d latest=now
| timechart span=1d count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">trend</option>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">inverse</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>
</dashboard>

[skoelpin]

You will need to use relative_time and eval to calculate the number from yesterday vs the number from today which will then display as a single value. What is your timespan you want to compare? Yesterdays value compared to todays value?

[umsundar2015]

yes , i need yesterday value compared with today .can you please help me with code

[kmorris_splunk]

Take a look at the Splunk Dashboard Examples app:

https://splunkbase.splunk.com/app/1603/

Under Single Value Elements section there are examples.