I have this query
|inputlookup test | search Feed=win|stats dc(ServerName) as ExpectedCount|appendcols[ search index=win earliest=-1d@d latest=-0d@h
| stats dc(host) as Currentcount ]|eval delta=ExpectedCount-Currentcount
Now I want to display the current count as single value along with delta in red/green with arrow
Can you please help
how can the query be changed so that the xml need not be written, how to use the timechart command to dispaly the difference.
@KASKIRANA1122, what you are requesting seems to be a candidate for Splunk Status Indicator Custom Visualization.
Please see below a run anywhere dashboard which shows icon color based on Delta and also Current Value.
Following is the complete Simple XML:
<dashboard>
<label>Single Value with delta icon and color</label>
<search>
<query>| makeresults
| fields - _time
| eval ExpectedCount=substr("".random(),0,4)
| appendcols [search index=_internal sourcetype=splunkd log_level!=INFO earliest=-1d@d latest=-0d@h
| stats count as Currentcount]
| eval delta=ExpectedCount-Currentcount</query>
<sampleRatio>1</sampleRatio>
<done>
<condition match="$job.resultCount$==0">
<set token="tokCurrentCount">0</set>
<eval token="tokDelta">$result.delta$</eval>
</condition>
<condition>
<set token="tokCurrentCount">$result.Currentcount$</set>
<eval token="tokDelta">$result.delta$</eval>
</condition>
</done>
</search>
<row>
<panel>
<title>Current Value (Delta)</title>
<viz type="status_indicator_app.status_indicator">
<search>
<query>| makeresults
| eval display="$tokCurrentCount$ ($tokDelta$)"
| eval icon=if($tokDelta$>=0,"arrow-circle-o-up","arrow-circle-o-down")
| eval color=if($tokDelta$>=0,"#65a637","#d93f3c")
| table display icon color
</query>
</search>
<option name="height">150</option>
<option name="status_indicator_app.status_indicator.colorBy">field_value</option>
<option name="status_indicator_app.status_indicator.fillTarget">background</option>
<option name="status_indicator_app.status_indicator.fixIcon">warning</option>
<option name="status_indicator_app.status_indicator.icon">field_value</option>
<option name="status_indicator_app.status_indicator.precision">0</option>
<option name="status_indicator_app.status_indicator.showOption">1</option>
<option name="status_indicator_app.status_indicator.staticColor">#555</option>
<option name="status_indicator_app.status_indicator.useColors">true</option>
<option name="status_indicator_app.status_indicator.useThousandSeparator">true</option>
</viz>
</panel>
</row>
</dashboard>