I have a dashboard on weekly bandwidth usage, and would like to get trending on the multiple reports that use the Single Value Visualisation to show if it was up/down from the previous week. However, not sure which command I should be using. One of my searches as an example is for avg. bandwidth per users:
... | stats sum(bandwidth_total) as Bandwidth by user
| stats avg(Bandwidth) as Bandwidth
| eval Bandwidth = tostring(Bandwidth,"commas")
Time range: Previous Week
I know the Enterprise Security app has an arrow for trending for real-time/historic data, but how do I do this in the normal search app?
Hi lmaclean,
download the dashboard example app https://splunkbase.splunk.com/app/1603/ and check out the dashboard /en-US/app/simple_xml_examples/simple_single
or /en-US/app/simple_xml_examples/simple_single_color
to see how this is done.
Hope this helps ...
cheers, MuS
The later one is only for Splunk 6.3 available, the former started at Splunk 6.0