How to display two result count in value visualization?

[Roberto-P]

Hi community, 

I have the follow search that return two number for today and yesterday device count per index xyz but i'm not able to visualize both them as show below the "today" is missing

This is the search:

| tstats dc(host) where index=*01* earliest=-1d@d latest=-0d@d | multikv | eval TimeWindow="yesterday"
| append 
    [tstats dc(host) where index=*01* earliest=-0d@d latest=now | multikv | eval TimeWindow="today"]

Could you please help me to understand how to have a result like this indication today vs yesterday?

Thank you

Roby

[richgalloway]

The SingleValue visualization displays one value.  If the results are from the timechart command then the SV also can show a sparkline of previous values and the difference between the current value and the previous one.  There is no provision for displaying 2 values.

[rut · Accepted solution]

Hi @Roberto-P, I think changing the range from 2 days ago to now, combined with "by _time span=1d" would be enough to get your results in a single search. The addition of the grouped _time field would ensure the visualization can compare it's value to the previous value:

| tstats dc(host) as hosts, where index=*01* by _time span=1d

Under format visualization (the brush), you should set the following settings to remove the sparkline and display the percentage:

[Roberto-P]

Thanks a lot Rut for the new search that solved my problem. it works great !