Splunk Search

Single value visualisation and trend value


I have db queries running every 5 minutes each logging a record of multiple fields and values. I have the following single value panel defined:

          <query>index=db_index| regex source="db_prod/.*entered.*" | timechart span=5m dc(id)</query>
        <option name="colorBy">trend</option>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="refresh.time.visible">1</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="trendInterval">-1h</option>
        <option name="underLabel">Compared to Previous Hour</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>

Looking at the values displayed in the panel, I'm having difficulty understanding how the single value and the displayed trend are being calculated. The questions I have are:

  1. With the declared search and associated parameters which data point/points are picked to compute the single value?
  2. Which data points are used to compute the trend value?
0 Karma


The search is returning the distinct count of ids - dc(id) - in each 5 minute period - span=5m.

The trend will be displayed as the number itself rather than percentage (absolute) , with up trends being colored as good (standard) and the prior point in the trend being the point 1 hour previously.

Here's a good example by kkrdo, complete with a test data generator you can play with. After you play around a bit, you can then port the knowledge back to your real data -


If you find his example helps you, then please upvote him.

0 Karma