Splunk Search

Why is my single visualization w/trendline total display off by 1?

jaj
Path Finder

i have the following query and the events/results show "5" but the Single w/Trendline Visualization shows "4".

index=logs source="*tst*" | search ("Attempt" AND "status=SUCCESS") |
timechart count as Total

alt text

0 Karma
1 Solution

niketnilay
Legend

@jaj you should try to understand how single value trendline works first.

By default the trendline result is the lastest value and the trend value is the difference of latest compared to the penultimate number i.e. comparison of last value with second last.

As per your example single value result is 4 (on 01/21) and trend value is 4-0 (0 on 1/20). The same is also highlighted in trendline as last two data point being of bold black color.

PS: You can change the default Compare to option using UI > Edit > Format Visualization or Simple XML.

However in case you need to compare/built trendline with non zero values you have two options

1) use timechart with cont=f which shows only non zero values in the timechart and also breaks the continuity of the chart.

2) use command | filldown which fills null values as previous not null value. Since count fills each time bucket with 0 you may have to tweak the query before using fillnull.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketnilay
Legend

@jaj you should try to understand how single value trendline works first.

By default the trendline result is the lastest value and the trend value is the difference of latest compared to the penultimate number i.e. comparison of last value with second last.

As per your example single value result is 4 (on 01/21) and trend value is 4-0 (0 on 1/20). The same is also highlighted in trendline as last two data point being of bold black color.

PS: You can change the default Compare to option using UI > Edit > Format Visualization or Simple XML.

However in case you need to compare/built trendline with non zero values you have two options

1) use timechart with cont=f which shows only non zero values in the timechart and also breaks the continuity of the chart.

2) use command | filldown which fills null values as previous not null value. Since count fills each time bucket with 0 you may have to tweak the query before using fillnull.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jaj
Path Finder

@niketnilay thanks for the response and explanation.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...