Splunk Search

Why is my single visualization w/trendline total display off by 1?

jaj
Path Finder

i have the following query and the events/results show "5" but the Single w/Trendline Visualization shows "4".

index=logs source="*tst*" | search ("Attempt" AND "status=SUCCESS") |
timechart count as Total

alt text

0 Karma
1 Solution

niketn
Legend

@jaj you should try to understand how single value trendline works first.

By default the trendline result is the lastest value and the trend value is the difference of latest compared to the penultimate number i.e. comparison of last value with second last.

As per your example single value result is 4 (on 01/21) and trend value is 4-0 (0 on 1/20). The same is also highlighted in trendline as last two data point being of bold black color.

PS: You can change the default Compare to option using UI > Edit > Format Visualization or Simple XML.

However in case you need to compare/built trendline with non zero values you have two options

1) use timechart with cont=f which shows only non zero values in the timechart and also breaks the continuity of the chart.

2) use command | filldown which fills null values as previous not null value. Since count fills each time bucket with 0 you may have to tweak the query before using fillnull.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@jaj you should try to understand how single value trendline works first.

By default the trendline result is the lastest value and the trend value is the difference of latest compared to the penultimate number i.e. comparison of last value with second last.

As per your example single value result is 4 (on 01/21) and trend value is 4-0 (0 on 1/20). The same is also highlighted in trendline as last two data point being of bold black color.

PS: You can change the default Compare to option using UI > Edit > Format Visualization or Simple XML.

However in case you need to compare/built trendline with non zero values you have two options

1) use timechart with cont=f which shows only non zero values in the timechart and also breaks the continuity of the chart.

2) use command | filldown which fills null values as previous not null value. Since count fills each time bucket with 0 you may have to tweak the query before using fillnull.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jaj
Path Finder

@niketnilay thanks for the response and explanation.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...