Dashboard Studio Single Value with Trendlines

[chrisboy68]

Hi, struggling to get single values to show with trendline comparing to previous month.

| bin span=1mon _time
| chart sum(cost) as monthly_costs over bill_date 

Tried differnt varations. The above will show a single value for each month, but I want to add a trendline to the single value to compare to the previous month. Any ideas?

Thanks!

[chrisboy68]

Hi, this https://docs.splunk.com/Documentation/Splunk/9.4.0/DashStudio/trellisLayout.  Specifly like this sample.  With each month, cost and the trend line comparing to previous month.

[ITWhisperer]

So far, you have only mentioned 2 dimensions, cost and time - what else are you breaking your statistics down by?

[chrisboy68]

This is probably why I'm getting confused.

Jan	100
Feb	105
March	90

Given this table, I want to have a single value trellis view that depicts the month total , with a trend compared to the previous month.

Jan 100 (no trend) , Feb 105 (shows trend up 5), March 90 (shows trend down 15).

I'm going to play with timewrap, maybe I'm going down the wrong path.

[MMahlberg]

I was struggling with the same task and went down the rabbit hole trying out every known command. The example in the dashboard studio is unfortunately not correct.

Timewrap looks like it could work, but splunk somehow gets confused with it in the foreach command.

This is what i came up with:

```   aggregation over month ```
| eval month = strftime(_time, "%Y-%m") 
| stats   count by month

```   transposing to to get it into right format and adding totals below```
| transpose 0 header_field=month
| addcoltotals

```   shifting everything one column to the right if the "column" field is not emty ```
| eval p = "" 
| foreach 20* [ 
    eval v = '<<FIELD>>', 
         <<FIELD>> = if(isnotnull(column), p, '<<FIELD>>'), 
         p = if(isnotnull(column), v, p) 
    ] 
| fields - p v

```   splunk NEEDS a _time field for Trellis to work. No idea why ```
| eval _time = now()
| table _time 20*

make sure to disable the sparkline and change the trend to percentage. 

[ITWhisperer]

| bin span=1mon _time
| chart sum(cost) as monthly_cost over _time

[chrisboy68]

Keep getting "Select a valid trellis split by field", used "_time" and tried "monthly_cost" . 

[ITWhisperer]

"Trellis"? Where did that come from? Please clarify what you are actually trying to do?