topic Re: Sparkline returning '0' or '1' in Dashboards & Visualizations

Why is sparkline returning '0' or '1'?

lennys26 — Tue, 06 Dec 2022 14:46:28 GMT

I have a query that returns an avg calculation over time and I am using a sparkline to try to show the results for each 'period' over that time, however although my results are showing a correct value, my sparkline only shows a value of 0 or 1.

My search is:

| tstats SUM(ABC) as ABC, sum(DEF) as DEF where index=FOO earliest=-4h latest=-45m by _time platform span=5m | eval AVG_ABC=((sum(DEF)/sum(ABC))/60) | stats sparkline avg(AVG_ABC) by platform

Instead of the single line result with the sparkline over time, I get the following:

Can anyone point me in the right direction? Essentially I am looking to create something like a single number value viz with a trendline.

Thanks.

Re: Sparkline returning '0' or '1'

ITWhisperer — Tue, 06 Dec 2022 12:18:06 GMT

Try this since you have already renamed sum(DEF) as DEF and sum(ABC) as ABC

| eval AVG_ABC=(DEF/ABC)/60

Re: Sparkline returning '0' or '1'

lennys26 — Tue, 06 Dec 2022 13:48:23 GMT

Hi@ITWhisperer. Bad SPL on my side (or perhaps i just foobar'ed by code when I was replacing all of the FOOs and BARs in my post 😁), but either way, thanks for the correction.

Anyhow, I have made the change, but this does not affect the end result.

Re: Sparkline returning '0' or '1'

ITWhisperer — Tue, 06 Dec 2022 14:09:40 GMT

| tstats SUM(ABC) as ABC, sum(DEF) as DEF where index=FOO earliest=-4h latest=-45m by _time platform span=5m | eval AVG_ABC=(DEF/ABC)/60 | stats sparkline(avg(AVG_ABC)) by platform

Re: Sparkline returning '0' or '1'

lennys26 — Tue, 06 Dec 2022 14:28:33 GMT

Ahh haa! I had spaces between the 'sparkline' and the function:

| stats sparkline avg(AVG_LOC) by platform

instead of

| stats sparkline(avg(AVG_LOC)) by platform

The strange thing is that my notes show that I have used this with the space in the past. Either way, it is working now.

Thanks.