Splunk Search

Add second value to Single Value panel

pimoa
Engager

We've setup a new Splunk dashboard and I'm looking to improve the trend graphs/panels.

We now have three panels each telling us something about a specific type of event. These panels are shown in the screenshot below:

Three panels

Top to bottom,

  • the first shows the number of events in the current rolling period (of 30 days).
  • The second shows a trend graph of the number of events every day over the past 3 months.
  • The third and last shows the number of events in this year to the current data (YTD).

I'd like to clean this up and combine it into one panel. Ideally it would look something like:

Data combined into panel

I've been messing with CSS files, but that is not a sustainable solution.
Also I've found the Splunk documentation on how to Generate a single value. This give me part of what I'm looking for. But this lacks the Year to Data value and I need the trend line to be more prominent.

From Splunk, single value with trend but without YTD

Any suggestions to how to make this work?

0 Karma
1 Solution

niketn
Legend

@pimoa you can use underLabel option of Single Value visualization to add a caption with token which can have value of Year To Date value using an independent search.

alt text

Following is a run anywhere example based on Splunk's _internal index which runs an independent search to pull current year count and uses <progress> search event handler to set the token for total count for Year to Date. Then the same token is used in Single Value with underLabel.

<dashboard>
  <label>Single Value with Trend and Additional Info</label>
  <!-- Search Query for Year To Date Data -->
  <search>
    <query>| tstats count where index=_internal earliest=@y</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
    <progress>
      <set token="tokYearToDate">$result.count$</set>
    </progress>
  </search>
  <row>
    <panel>
      <single>
        <search>
          <query>| tstats count where index=_internal earliest=-30d by _time span=1d</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">trend</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="underLabel">$tokYearToDate$ (YTD)</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@pimoa you can use underLabel option of Single Value visualization to add a caption with token which can have value of Year To Date value using an independent search.

alt text

Following is a run anywhere example based on Splunk's _internal index which runs an independent search to pull current year count and uses <progress> search event handler to set the token for total count for Year to Date. Then the same token is used in Single Value with underLabel.

<dashboard>
  <label>Single Value with Trend and Additional Info</label>
  <!-- Search Query for Year To Date Data -->
  <search>
    <query>| tstats count where index=_internal earliest=@y</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
    <progress>
      <set token="tokYearToDate">$result.count$</set>
    </progress>
  </search>
  <row>
    <panel>
      <single>
        <search>
          <query>| tstats count where index=_internal earliest=-30d by _time span=1d</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">trend</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="underLabel">$tokYearToDate$ (YTD)</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

richgalloway
SplunkTrust
SplunkTrust

To address the title of this question, a Single Value visualization cannot contain more than 1 value (not counting the trend and sparkline).

Have you considered putting your three panels on the same row so they're next to each other?

Another option is to edit the dashboard source so the visualizations are in one panel.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...