Hi Everyone,
I have one dashboard which consists of several panels . Like LOGIN,TIMEOUT.
I want to display the Trend Indicator for the count values.
Suppose I select the date Range between 11th September to 13th September .
The Timeout count for11th september is 3694,12th sep is 1209 and 13th september is 2755.
I want to display the trend Indicator which will show the percentage increase/decrease of timeout count values.
I have already use <option name="trendDisplayMode">percent</option> . But not sure the percentage increase and decrease count is coming correct.
Can someone guide me do I need to add anything else to show Trend Indicator for comparison.
Below is my XML Code:
<panel>
<single>
<title>TIMEOUT</title>
<search>
<query>index="abc" sourcetype=xyz Timeout $Org$ | bin span=1d _time |stats count by _time</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="colorBy">value</option>
<option name="drilldown">all</option>
<option name="height">100</option>
<option name="numberPrecision">0</option>
<option name="rangeValues">[0,10,25,40]</option>
<option name="trendDisplayMode">percent</option>
<option name="unit"></option>
<option name="rangeColors">["0xFF0000","0xFF0000","0xFF0000","0xFF0000","0xFF0000"]</option>
<option name="useColors">1</option>
<drilldown>
<set token="show_panel">true</set>
<set token="selected_value">$click.value$</set>
</drilldown>
</single>
</panel>
you can not apply trend for more than two consecutive values.
you can show trend last two days or last two months or last 2 hours or last 2 years. not last 3 days , 3 hours or 3 years.
<dashboard>
<label>Trend-example</label>
<row>
<panel>
<single>
<search>
<query>index=_internal source="*splunkd.log" log_level="error" | timechart span=1d count</query>
<earliest>-1d@d</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
</dashboard>
Can someone guide me on this.