Dashboards & Visualizations

trendline wma2 is showing different results between Statistics Table and Single Value

WEI_LI_YU
Engager

Hi splunkers,

I'm using the same query for different panels - timechart, statistics table and single value.
Noticed that the single value is showing the difference between the previous and the current date.
On statistics table the wma2 is working as designed, trendline also.

However, I would like my timechart to show a trendline with the difference between the dates. By having negative difference it should go below Y=0.

Here is the query I'm using:

index=reporting sourcetype=reporting_json alertId=1234
| timechart span=1w count(alertId) as Test
| trendline wma2("x") as trend
| sort - _time

Example of statistics table results:
Date Count WMA
June 7 1593 1976
june 6 2742 2650.3333

On Single value it is showing: 1593 and smaller number on its side, -1,149

0 Karma
1 Solution

WEI_LI_YU
Engager

Found the solution by using delta - http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Delta

It was changed to the below:

index=reporting sourcetype=reporting_json alertId=1234
| timechart span=1w count(alertId) as Test
| delta Test p=1 as Difference

View solution in original post

0 Karma

WEI_LI_YU
Engager

Found the solution by using delta - http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Delta

It was changed to the below:

index=reporting sourcetype=reporting_json alertId=1234
| timechart span=1w count(alertId) as Test
| delta Test p=1 as Difference

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@WEI_LI_YU - Glad you were able to find the solution to your question. Please don't forget to click "Accept" to resolve your question so others can find it. Thanks!

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...