topic Re: How to use sparkline in search with inputlookup? in Dashboards & Visualizations

How to use sparkline in search with inputlookup?

sbimizry — Tue, 06 Aug 2019 13:32:53 GMT

Hi,
I try used it... index=indexname | chart sparkline count by field and this worked, but this not worked | inputlookup lookupname | chart sparkline count by field why and how to fix it? How to I must use sparkline with inputlookup?
Thanks

Re: How to use sparkline in search with inputlookup?

chris1337 — Tue, 06 Aug 2019 13:55:50 GMT

Hi,

are you sure, that your inputlookup is delivering some fields+values? Do you use the right fieldname to count? Is this fieldname available in your lookup output?

I tested it, there are no problems right now.

Greetings Chris

Re: How to use sparkline in search with inputlookup?

sbimizry — Tue, 06 Aug 2019 14:05:05 GMT

Yes, I'm sure everything is correct, but they do not work

Re: How to use sparkline in search with inputlookup?

chris1337 — Wed, 30 Sep 2020 01:38:56 GMT

Could you plz try the following:

| inputlookup lookupfile.csv

Is there any output?
Is there a field with values?

If yes, try:
| inputlookup lookupfile.csv | chart sparkline count by field_you_are_looking_for

Greetings, Chris

Re: How to use sparkline in search with inputlookup?

sbimizry — Tue, 06 Aug 2019 14:48:07 GMT

Output from lookup is exist and fields too, but sparkline not work

Re: How to use sparkline in search with inputlookup?

chris1337 — Tue, 06 Aug 2019 14:50:53 GMT

Ok, then I don´t know. My local test here worked fine. I´m sorry, I could not help you.

Greetings Chris

Re: How to use sparkline in search with inputlookup?

kmaron — Tue, 06 Aug 2019 14:51:21 GMT

A sparkline is a trend over time. Does your inputlookup include _time?

Re: How to use sparkline in search with inputlookup?

sbimizry — Tue, 06 Aug 2019 15:16:49 GMT

Yes, this field exists

Re: How to use sparkline in search with inputlookup?

niketn — Tue, 06 Aug 2019 16:26:27 GMT

@sbimizry what is the field containing epoch time in your lookup? Or do you have time in lookup available as String time? In either case community would be able to assist you better if you provide field names with some sample data from your lookup file.

For example

time          field
2019/01/01 20:08:00          value1
2019/01/01 20:09:00          value1
2019/01/01 20:10:00          value1
2019/01/01 20:08:00          value2
2019/01/01 20:10:00          value2

Then following would be the query. If time in lookup is String time following eval with strptime() would be required to convert string time to epoch. Otherwise _time can be directly overridden with | eval _time=time when time field is already epoch time.

| inputlookup lookupname 
| eval _time=strptime(time,"%Y/%m/%d %H:%M:%S")
| chart sparkline count by field

Re: How to use sparkline in search with inputlookup?

sbimizry — Wed, 07 Aug 2019 10:00:11 GMT

I did it, but it doesn’t work.
Example my data:

result_time                 name
1565083380               value1
1565083230               value1
1565087350               value2
1565078330               value3
1565066540               value2

Re: How to use sparkline in search with inputlookup?

efloss — Thu, 25 Aug 2022 21:46:08 GMT

If anyone ever runs into this in the future and are having issues like I was, everything in this post applies but even though you are calling | inputlookup and your searching time frame doesn't apply to bringing back results, you do need to search over the range for the sparkline to form properly. Basically for a 30 days sparkline, making sure you run the search over the last 30 days even though its not actually searching 30 days of events.