How to create a single value trend to show the difference based on the previous day?

[seetharamanss]

Hi ,

I need to create a single value visualization with the trend indicator. The trend indicator should be the difference based on the previous day difference. Below is the search and the response from the search But when it calculates the trend, it's taking percentage change ie, (80-20)/20 *100% = 300% instead of simply giving the difference as it is already in % (80%-20%)= +60% .

Please advise if I'm missing out something here.

day     FILLCNT     tempcount   FILRATE     totalcount
20    1        1746         80          2193
19    1        447        20          2193

      <query> sourcetype=mysourcetype  | eval  day = strftime(strptime(Timestamp,"%Y-%m-%d-%H.%M.%S.%6N"),"%d") | eval FILLCNT =if((myfillfield = "Y"),1,0)|  stats count as tempcount by day,FILLCNT| eventstats sum(tempcount) as totalcount by cur |eval FILRATE = round((tempcount /totalcount) * 100,0) |sort -FILLCNT -day </query> 
      <earliest>-2d</earliest>
      <latest>now</latest>
    </search> 
   60
    <option name="field">FILRATE</option>
    <option name="afterLabel">%</option>
    <option name="colorBy">value</option>
    <option name="colorMode">none</option>
    <option name="unitPosition">after</option>
    <option name="numberPrecision">0</option>
    <option name="showSparkline">true</option>
    <option name="showTrendIndicator">true</option>
    <option name="trendColorInterpretation">standard</option>
    <option name="trendDisplayMode">percent</option>
    <option name="useColors">1</option>
    <option name="useThousandSeparators">true</option>
    <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0x65a637","0x65a637"]       </option>
    <option name="rangeValues">[0,30,80,90]</option>
    <option name="linkView">search</option>
    <option name="drilldown">none</option>

[colinmchugo]

Hi lads, i am having a similar issue. I have multple panels just doing a stats count to see the number of events. But i want to be able to compare those events for the previous 24 hours and only weekdays. Is there anyway you could assist? thanks C.

[sundareshr]

Change the trendDisplayMode to standard from percent.

<option name="trendDisplayMode">absolute</option>  

[seetharamanss]

Hi,
I tried it . Still have the same problem.

[sundareshr]

Try this.

<single>
<search>
<query>sourcetype=mysourcetype earliest=-2d@d | eval day=strptime(Timestamp,"%Y-%m-%d-%H.%M.%S.%6N") | eval FILLCNT=if((myfillfield = "Y"),1,0) | bin span=1d day | stats count as tempcount count(eval(mygillfield="Y")) as FILLCNT by day | eventstats sum(tempcount) as totalcount | eval FILRATE=round((tempcount/totalcount) * 100,0) | fields day FILRATE</query>
     <earliest>-2d</earliest>
<latest></latest>
</search>
        <option name="drilldown">none</option>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="showSparkline">0</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
</single>