help on single panel with trend

[jip31]

hello

I need to display a single panel with trend but it doesnt works

does it miss something?

<dashboard>
  <label>VIZ</label>
  <row>
    <panel>
      <single>
        <search>
          <query>`CPU` 
| fields process_cpu_used_percent host 
| search host=06999   
| stats count as "Number of peaks" by host</query>
          <earliest>-7d@h</earliest>
          <latest>now</latest>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">1</option>
        <option name="useColors">1</option>
         <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
          <option name="trendInterval">-1h</option>
        <option name="underLabel">Compared to an hour before</option>
      </single>
    </panel>
  </row>
</dashboard>

Thanks

[gcusello · Accepted solution]

Hi @jip31,

to display trend in single panels you cannot use stats command, but you need a search that gives you two values in two different times, in addition you cannot aggregate values using the BY clause, in other words, your search should be something like this:

`CPU` 
| fields process_cpu_used_percent host 
| search host=06999   
| timechart bins=2 count as "Number of peaks" 

 Ciao.

Giuseppe

[jip31]

Hi Thanks for your answer

[gcusello]

Hi @jip31,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉