Dashboards & Visualizations

Format vizualisation not showing trend settings

snigdhasaxena
Communicator

I have added timechart and span in my query for dashboard panel (single value visualization). While panel shows trend settings for other panels with similar query, the 2 panels do not get it

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If there are no events returned then there is no trend. However, to display "0" instead of "No results found" use appendpipe.

index=xyz EventCode=4624 OR EventCode=4625 |timechart span=24h count by user 
| appendpipe [ stats count | eval user="N/A" | where count==0 ]
---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Obviously, something is different between the one panel that works and the two that don't. I can't see your screen from here, so you'll have to describe the differences to me before I can help.

---
If this reply helps you, Karma would be appreciated.
0 Karma

snigdhasaxena
Communicator

Query for the panel that doesn't show trend indicator settings :
index=xyz EventCode=4624 OR EventCode=4625 |timechart span=24h count by user

Query for the panel that shows trend indicator settings:
index=xyz (sourcetype=linux_secure eventtype="sshd_authentication" ) OR (eventtype=wineventlog_security AND EventCode=4625) |timechart span=4h values(src_ip) by user| timechart span=24h count

0 Karma

snigdhasaxena
Communicator

@richgalloway What I found is if my search doesn't retrieve any events it doesn't show trend settings and says "No result found" while if it shows events , it shows the trend, sparkline,etc. What can we do to fix "No result found" and get indicators for 0 events as well ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...