Hi ,
I need to create a single value visualization with the trend indicator. The trend indicator should be the difference based on the previous day difference. Below is the search and the response from the search But when it calculates the trend, it's taking percentage change ie, (80-20)/20 *100% = 300%
instead of simply giving the difference as it is already in % (80%-20%)= +60% .
Please advise if I'm missing out something here.
day FILLCNT tempcount FILRATE totalcount
20 1 1746 80 2193
19 1 447 20 2193
<query> sourcetype=mysourcetype | eval day = strftime(strptime(Timestamp,"%Y-%m-%d-%H.%M.%S.%6N"),"%d") | eval FILLCNT =if((myfillfield = "Y"),1,0)| stats count as tempcount by day,FILLCNT| eventstats sum(tempcount) as totalcount by cur |eval FILRATE = round((tempcount /totalcount) * 100,0) |sort -FILLCNT -day </query>
<earliest>-2d</earliest>
<latest>now</latest>
</search>
60
<option name="field">FILRATE</option>
<option name="afterLabel">%</option>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="unitPosition">after</option>
<option name="numberPrecision">0</option>
<option name="showSparkline">true</option>
<option name="showTrendIndicator">true</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">percent</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">true</option>
<option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0x65a637","0x65a637"] </option>
<option name="rangeValues">[0,30,80,90]</option>
<option name="linkView">search</option>
<option name="drilldown">none</option>
Hi lads, i am having a similar issue. I have multple panels just doing a stats count to see the number of events. But i want to be able to compare those events for the previous 24 hours and only weekdays. Is there anyway you could assist? thanks C.
Change the trendDisplayMode
to standard from percent.
<option name="trendDisplayMode">absolute</option>
Hi,
I tried it . Still have the same problem.
Try this.
<single>
<search>
<query>sourcetype=mysourcetype earliest=-2d@d | eval day=strptime(Timestamp,"%Y-%m-%d-%H.%M.%S.%6N") | eval FILLCNT=if((myfillfield = "Y"),1,0) | bin span=1d day | stats count as tempcount count(eval(mygillfield="Y")) as FILLCNT by day | eventstats sum(tempcount) as totalcount | eval FILRATE=round((tempcount/totalcount) * 100,0) | fields day FILRATE</query>
<earliest>-2d</earliest>
<latest></latest>
</search>
<option name="drilldown">none</option>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
<option name="rangeValues">[0,30,70,100]</option>
<option name="showSparkline">0</option>
<option name="showTrendIndicator">1</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useColors">0</option>
<option name="useThousandSeparators">1</option>
</single>