Splunk Search

How to edit my search to display the trend line on a single value visualization?

mmwilson
Explorer

Hi Fellow Splunkers,

I have a search that is using lookup tables to show how many of our hosts are reporting. When I run the query, it populates the number for me, but it doesn't draw the trend line and i haven't been able to find a way to enable it, unfortunately. Best advice I can find is to run a timechart, but having a hard time converting this over.

| `asset_eventcount` 
| search (`get_category(pci)`) () tag= expected 
| sort 0 - lastTime 
| `uitime(firstTime)` 
| `uitime(lastTime)` 
| eval last_logged = round((now() - lastTime)/86400) 
| replace -1 with 0 in last_logged 
| eval last_logged = if(last_logged<30, "Logging", last_logged) 
| eval last_logged = if(last_logged>30, "Stopped Logging", last_logged) 
| eval last_logged = if(isnull(last_logged) OR last_logged="", "Never Logged", last_logged) 
| stats count by last_logged | where last_logged="Logging" | fields count

Thanks!

0 Karma

gcusello
Legend

Hi mmwilson,
why don't you use _time?
you could replace your last row with

| where last_logged="Logging" 
| timechart bins=2 count 

Bye.
Giuseppe

0 Karma

mmwilson
Explorer

We have a master list of thousands of hosts, and one of our dashboards has a single value visualization for active hosts, inactive hosts, and never before seen hosts. We'd like to visualize it with a trend to see if new hosts have been added, or to see if any have stopped logging at a quick glance.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

In order to do a timechart, you need to have a _time.

You also need to be charting a consistent metric, not words.

Regardless of that, I'm not sure what a trend line on this data would really tell you.

To a degree, this data is the reverse of a trend... or the shadow of the inverse of a trend not happening...

Related trends that might be mapped

How many servers were reporting on each day.
How many servers were NOT reporting on each day.
How many cumulative server-non-reporting days have accrued as/of each date

What exactly do you want the trendline to tell you?

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...