Splunk Enterprise

Dashboard Studio Single Value with Trendlines

chrisboy68
Contributor

Hi, struggling to get single values to show with trendline comparing to previous month.

 

| bin span=1mon _time
| chart sum(cost) as monthly_costs over bill_date 

 

Tried differnt varations. The above will show a single value for each month, but I want to add a trendline to the single value to compare to the previous month. Any ideas?

Thanks!

Labels (1)
0 Karma

chrisboy68
Contributor

Hi, this https://docs.splunk.com/Documentation/Splunk/9.4.0/DashStudio/trellisLayout.  Specifly like this sample.  With each month, cost and the trend line comparing to previous month.

chrisboy68_0-1738005216924.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

So far, you have only mentioned 2 dimensions, cost and time - what else are you breaking your statistics down by?

0 Karma

chrisboy68
Contributor

This is probably why I'm getting confused.

Jan100
Feb105
March90

 

Given this table, I want to have a single value trellis view that depicts the month total , with a trend compared to the previous month.

Jan 100 (no trend) , Feb 105 (shows trend up 5), March 90 (shows trend down 15).

I'm going to play with timewrap, maybe I'm going down the wrong path.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| bin span=1mon _time
| chart sum(cost) as monthly_cost over _time
0 Karma

chrisboy68
Contributor

Keep getting "Select a valid trellis split by field", used "_time" and tried "monthly_cost" . 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

"Trellis"? Where did that come from? Please clarify what you are actually trying to do?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...