topic Re: How Do I Add LatestEvent Column to a Sparkline Chart? in Splunk Search

How Do I Add LatestEvent Column to a Sparkline Chart?

JordanPeterson — Wed, 22 Aug 2018 22:26:30 GMT

I have a search that is currently working to give me a spark line for different event types. The search looks like this:

`eventtype=PS-* 
| chart sparkline count by eventtype`

Now I can take the fields from the chart and pipe that to table and it works fine too. What I want to do is add a "Latest" column for each EventType that displays the date of the most recent event for each event type. From there I'd also like to add a "First" field as well.

I've tried using stats and eval but those both seem to break the sparkline.

Re: How Do I Add LatestEvent Column to a Sparkline Chart?

niketn — Thu, 23 Aug 2018 02:54:39 GMT

@JordanPeterson can you try the following?

 eventtype=PS-* 
 | chart sparkline count latest(_time) as "Latest Event" by eventtype
 | fieldformat "Latest Event"=strftime('Latest Event',"%Y/%m/%d %H:%M:%S")

Re: How Do I Add LatestEvent Column to a Sparkline Chart?

JordanPeterson — Thu, 23 Aug 2018 20:23:00 GMT

@niketnilay That worked perfectly. Thank you.