Sparkline and Trend Indicator splunk

[dchalasani]

Hi,

I did Sparkline and Trend Indicator splunk as compared to lastweek.

In the result it showing as 92 means in 2 digit value only it is showing. Actually it has to show in like 9240000 like this.

Can any one please help me with this.

source code

<earliest>-7d</earliest>
      <latest>-60m@m</latest>
      <sampleRatio>1</sampleRatio>
    </search>
    <option name="trendColorInterpretation">standard</option>
    <option name="trendDisplayMode">absolute</option>
    <option name="trendInterval">-1h</option>
    <option name="colorBy">value</option>
    <option name="colorMode">none</option>
    <option name="numberPrecision">0</option>
    <option name="showTrendIndicator">1</option>
    <option name="showSparkline">1</option>
    <option name="useColors">0</option>
    <option name="useThousandSeparators">1</option>
    <option name="underLabel">Compared to lastweek</option>

Thanks

[niketn · Accepted solution]

Do you want to bucket alert_risk_level in 1 hour window? Use following query instead

index=aws sourcetype=description earliest=-7d 
| timechart span=1h count(alert_risk_level) as Risk_Identified

[dchalasani]

Thanks Nike!

[niketn]

@dchalasani, glad it worked. I have converted to answer. Please Accept Answer to close this question.

[dchalasani]

Ok...and The Trend Indicator is showing very small.. Can we make it big(Trend Indicator) to show in a effective way.

Thanks

[niketn]

All single value elements adjust according to the size of panel and amount of data. You can color your single value panel based on trends to make the same obvious. You should be able to Edit Panel and choose these settings from Format menu.

[dchalasani]

And I used string as

index=aws sourcetype=description earliest=-7d | stats count as alert_risk_level by _time | timechart span=60m max(alert_risk_level) | rename max(alert_risk_level) as Risk_Identified