Ingestion Rate Trend

Show the current ingestion rate — events per hour — as a single value, together with a trend indicator and a sparkline to provide temporal context. Useful on a system health dashboard where you want to know both the current rate and whether it is rising or falling.

Visualization: when the query uses timeChart(), the widget gains three additional display modes:

  • A value — the main central number shows the _count from the last bucket (depending on the Last Bucket property setting, see Single Value Property Reference).

  • A trend — the difference between the last and first bucket values of _count over the selected time window.

  • A sparkline — a small area chart below the value that shows how _count has changed over time. Toggle the Sparkline property to show or hide it (see Single Value Property Reference).

Screenshot showing a single value widget displaying an ingestion rate with a large central number, a trend indicator showing increase, and a sparkline area at the bottom showing historical data pattern, with Format Single Value panel visible on the right showing Sparkline toggled on and Colors set to By threshold

Figure 252. Ingestion Rate Trend


Sample input data:

@timestamphostloglevelmessageservice
1970-01-01T00:00:02svc-01infoUser login successfulauth-service
1970-01-01T00:00:02svc-02errorPayment failedpayment-service
1970-01-01T00:00:02svc-03infoProfile updateduser-service
1970-01-01T00:00:02svc-04warnSlow query detectedanalytics-service
1970-01-01T00:00:02svc-05infoCache refreshedcache-service

Query:

logscale
timeChart(span=1h)

Query breakdown:

  1. Groups all events into one-hour time buckets, producing a result with two fields per bucket: _bucket (the bucket start timestamp) and _count (the number of events ingested in that hour).

  2. The Single Value widget uses the _count from the last bucket as the displayed value, calculates the trend from the difference between first and last bucket, and renders the full time series as a sparkline.

Configuration:

  1. From the Search page, type your query in the Query Editor → click Run

  2. Choose Single Value in the Widget selector

  3. Click the style icon : this opens the Format panel on the side.

  4. Toggle the Trend property on to show the change between the first and last bucket values below the main number.

  5. Toggle the Sparkline property on to show the historical trend area below the value.

  6. In Text, enter a Label such as Ingested Events per Hour to describe the displayed value.

  7. Under Buckets, set First bucket and Last bucket to Exclude to omit potentially incomplete boundary buckets from the displayed value.

  8. Optionally, in Colors, set Method to By threshold and configure threshold values to color the value when it exceeds a critical level.

To customize this widget further, see Single Value Property Reference.