Splunk Search

Single value visualisation and trend value

Engager

I have db queries running every 5 minutes each logging a record of multiple fields and values. I have the following single value panel defined:

      <single>
        <title>Entered</title>
        <search>
          <query>index=db_index| regex source="db_prod/.*entered.*" | timechart span=5m dc(id)</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <refresh>3m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="colorBy">trend</option>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="refresh.time.visible">1</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="trendInterval">-1h</option>
        <option name="underLabel">Compared to Previous Hour</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>

Looking at the values displayed in the panel, I'm having difficulty understanding how the single value and the displayed trend are being calculated. The questions I have are:

  1. With the declared search and associated parameters which data point/points are picked to compute the single value?
  2. Which data points are used to compute the trend value?
0 Karma

SplunkTrust
SplunkTrust

The search is returning the distinct count of ids - dc(id) - in each 5 minute period - span=5m.

The trend will be displayed as the number itself rather than percentage (absolute) , with up trends being colored as good (standard) and the prior point in the trend being the point 1 hour previously.

Here's a good example by kkrdo, complete with a test data generator you can play with. After you play around a bit, you can then port the knowledge back to your real data -

https://answers.splunk.com/answers/330293/compare-option-in-single-value-in-splunk-63.html

If you find his example helps you, then please upvote him.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!