hello
I need to display a single panel with trend but it doesnt works
does it miss something?
<dashboard>
<label>VIZ</label>
<row>
<panel>
<single>
<search>
<query>`CPU`
| fields process_cpu_used_percent host
| search host=06999
| stats count as "Number of peaks" by host</query>
<earliest>-7d@h</earliest>
<latest>now</latest>
</search>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">1</option>
<option name="useColors">1</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trendInterval">-1h</option>
<option name="underLabel">Compared to an hour before</option>
</single>
</panel>
</row>
</dashboard>
Thanks
Hi @jip31,
to display trend in single panels you cannot use stats command, but you need a search that gives you two values in two different times, in addition you cannot aggregate values using the BY clause, in other words, your search should be something like this:
`CPU`
| fields process_cpu_used_percent host
| search host=06999
| timechart bins=2 count as "Number of peaks"
Ciao.
Giuseppe
Hi @jip31,
to display trend in single panels you cannot use stats command, but you need a search that gives you two values in two different times, in addition you cannot aggregate values using the BY clause, in other words, your search should be something like this:
`CPU`
| fields process_cpu_used_percent host
| search host=06999
| timechart bins=2 count as "Number of peaks"
Ciao.
Giuseppe
Hi Thanks for your answer
Hi @jip31,
good for you, see next time!
Ciao and happy splunking.
Giuseppe
P.S.: Karma Points are appreciated 😉