Displaying stats count as single value but with sparkline and trend indicator

[eddychuah]

Hi fellow Splunkers, I've read Single Value support docs and it seems to have distinct application for Stats or Timechart. When I use timechart:

sourcetype="error log" severity=ERROR someErrorcode | timechart count

it displays sparkline and trend correctly, however for the single value, it's using the Count of that error at the specific instance of time as opposed to the indicated desired span of time

I want to try to combine the two or have an end result that leverages both stats and timechart. I want to use the total count of events found in my span of time as my single value display but I also want a sparkline/heartbeat below showing the timeline of the event occurrences during my span and an up/down trend indicator

examples available in the Docs are too simplistic and seems to only use values that are already single values - ie. close stock price, temperature...

Thanking you for your help in advance!!!

[eddychuah]

Both very valid points

In the end, I ended up using 2 separate searches, 1 using stats count for single point and 1 using timechart for 'sparkline' and combined the two into 1 panel

[niketn]

@eddychuah yes sometimes it is better to segregate visualizations which layout different interpretation.

We had actually once built a timechart with column chart indicating real-time data volume and overlaid it with cumulative volume over time and turned on the overlay axis. This gave us a look at real time as well as cumulative volume and turning on Min/Max gave us final cumulative Total (all towards right).

[eddychuah]

@niketnilay excellent point, I've started to treat Splunk as lego and have fun w/ it instead of getting angry at the rigidity of certain visualizations and why it doesn't cover the most basic use cases

and that is also a great example you laid out, i'll def keep that in mind for future projects

cheers!

[camillak]

@eddychuah I'm having the same issue and reached the same conclusion that this would be the best option, i.e. to do a single value and a timechart, out of curiosity did you use any js to modify the size or position of the timechart? I want to make it look more like the single value sparkline.

[eddychuah]

Hi camillak, I did not do anything hardcore such as adding my own CSS file into the conf directories. What I was simply create 2 panels to do whatever I want (timechart and single value) and put the 2 panels together and Edited the dashboard, went into the "Source" and removed the

/ panel

/ row
row
panel

tags which bordered between the 2 panels such that it looks like 1 panel encapsulating 2 charts.

I gave up on the sparkline idea in this usecase upon further consideration, I was building a landing page for my app which shows a high level summary of overall system health and sparklines would have had very little value add.

[niketn · Accepted solution]

@ eddychuah, Following are couple of your options:

1) Use accum command to keep cumulative count of your events. This way the Single Value Result count will be Final Total Count and the trendline will be based on cumulative count i.e. keep increasing trendline if events are found for specific span and keep trendline at the same level if no events are found in specific span.

Try out following run anywhere search with Single Value visualization:

index=_internal sourcetype=splunkd log_level!=INFO
|  timechart count as Errors
|  accum Errors

2) Use addcoltotals or addtotals command to calculate total count and add to the end of the timechart results. This will show final total with trend lines going up and down as original timechart command. However, the final trend will be incorrect as it will always show a final jump to cumulative total.

Try out following run anywhere search with Single Value visualization:

index=_internal sourcetype=splunkd log_level!=INFO
|  timechart count as Errors
|  addcoltotals label="Total" labelfield="_time"

Please try out and see if one of the above options will work fine or not.

[skoelpin]

The problem with ... | stats count is that you lose everything except for the final count. Perhaps you should look into using eventstats which will create a new field of your count and allow you to keep all existing fields?

I'm assuming you want to write a single search as a base search and use the results in multiple panels?