I'm having an issue where building a glass table in ES for a single value delta ad-hoc search is showing up as N/A, but drilling into it shows me the visualization I want.
My search:
| inputlookup file.csv
| stats count by CASE_CLOSURETIME
| eval NewTime=strptime(CASE_CLOSURETIME,"%Y-%m-%d %H:%M:%S")
| eval _time=NewTime | sort -_time
| timechart count span=1mon
| tail 3
| sort _time
Essentially CASE_CLOSURETIME, is in the same time format as _time, and shows me the results I want with the historical trend as a single value visualization in SPL, but cannot get the same to show up in Glass Tables.
Because of the recent comment: Like the thread owner said, glass tables can only display single values. A timechart isn't part of that. See the docs for a description of what works.
Skalli
This question was about the single-value delta visualization, right? That typically is based on timechart like data? Also: it works fine if I use the sparkline visualization. Just the single-value delta visualization fails.
Did you ever find a solution to this? Running into the same today. Feel like the delta viz expects some specific fields (value and delta or so?) rather than just a timechart.
No I did not, as someone stated below the timechart w/ lookups isn't part of the design scheme (doesn't really make sense to me why that cant be added).
The route I was told to go from Splunk was to get the data ingested into an index and then call it that way.
Sorry, here's a better search (still the same results) but I know Glass Tables viz needs to end with timechart:
| inputlookup file.csv
| stats count by CASE_CLOSURETIME
| eval NewTime=strptime(CASE_CLOSURETIME,"%Y-%m-%d %H:%M:%S")
| eval _time=NewTime
| timechart count span=1mon