How to set the Trend indicator to show the increase and decrease in count over the period.

[aditsss]

Hi Everyone,

I have one dashboard which consists of several panels . Like LOGIN,TIMEOUT.

I want to display the Trend Indicator for the count values.

Suppose I select the date Range between 11th September to 13th September .

The Timeout count for11th september is 3694,12th sep is 1209 and 13th september is 2755.

I want to display the trend Indicator which will show the percentage increase/decrease of timeout count values.

I have already use <option name="trendDisplayMode">percent</option> . But not sure the percentage increase and decrease count is coming correct.

Can someone guide me do I need to add anything else to show Trend Indicator for comparison.

Below is my XML Code:

<panel>
<single>
<title>TIMEOUT</title>
<search>
<query>index="abc" sourcetype=xyz Timeout $Org$ | bin span=1d _time |stats count by _time</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="colorBy">value</option>
<option name="drilldown">all</option>
<option name="height">100</option>
<option name="numberPrecision">0</option>
<option name="rangeValues">[0,10,25,40]</option>
<option name="trendDisplayMode">percent</option>
<option name="unit"></option>
<option name="rangeColors">["0xFF0000","0xFF0000","0xFF0000","0xFF0000","0xFF0000"]</option>
<option name="useColors">1</option>
<drilldown>
<set token="show_panel">true</set>
<set token="selected_value">$click.value$</set>
</drilldown>
</single>
</panel>

[thambisetty]

you can not apply trend for more than two consecutive values.

you can show trend last two days or last two months or last 2 hours or last 2 years. not last 3 days , 3 hours or 3 years.

<dashboard>
  <label>Trend-example</label>
  <row>
    <panel>
      <single>
        <search>
          <query>index=_internal source="*splunkd.log" log_level="error" | timechart span=1d count</query>
          <earliest>-1d@d</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </single>
    </panel>
  </row>
</dashboard>

[aditsss]

Can someone guide me on this.