topic Re: Help required to add sparkline to table/stats in Dashboards & Visualizations

Help required to add sparkline to table/stats

peterchenadded — Fri, 07 Mar 2014 22:33:28 GMT

Your help is much appreciated.

Can get the following table

sourcetype="test_data" | table monitor1, monitor2, monitor3

monitor1, monitor2, monitor3
0, 1, 1
0, 0, 0
1, 1, 1

However would like the following

column1, column2, column3
monitor1, sparkline, 0
monitor2, sparkline, 1
monitor3, sparkline, 1

where column1 is the monitor name, column2 is sparkline of the values and column3 is the first top row

Re: Help required to add sparkline to table/stats

martin_mueller — Sat, 08 Mar 2014 00:07:35 GMT

Something like this?

index=_internal | stats sparkline(avg(date_second)) as s1 latest(date_second) as l1 sparkline(avg(date_minute)) as s2 latest(date_minute) as l2 sparkline(avg(date_hour)) as s3 latest(date_hour) as l3 | eval column1 = "monitor1 monitor2 monitor3" | makemv column1 | mvexpand column1 | eval column2 = case(column1=="monitor1",s1,column1=="monitor2",s2,column1=="monitor3",s3) | eval column3 = case(column1=="monitor1",l1,column1=="monitor2",l2,column1=="monitor3",l3) | fields column*

It'd be a bit less cumbersome to produce the desired result if you had events like this:

timestamp monitor="monitor1" value=1
timestamp monitor="monitor2" value=0
timestamp monitor="monitor2" value=1

Rather than this:

timestamp monitor1=1 monitor2=0 monitor3=1

Then you could add do something like this:

your base search | stats sparkline(avg(value)) latest(value) by monitor

Much more concise and flexible that way, depends on what your data actually looks like.

Re: Help required to add sparkline to table/stats

peterchenadded — Thu, 02 Nov 2017 07:34:47 GMT

I think the best way would be to untable on the results and then use stats

E.g.

Search
| streamstats count
| eval _time=now()+count*10
| untable _time field value
| stats sparkling(value), latest(value) by field