https://community.splunk.com/t5/Splunk-Search/Adding-Sparkline-based-on-eval-variable/m-p/490406#M136938 <P>Sparklines require _time to work. However, the initial <CODE>stats</CODE> command is returning only the DeviceCount and OSHealth fields. </P> Mon, 04 May 2020 13:39:30 GMT richgalloway 2020-05-04T13:39:30Z https://community.splunk.com/t5/Splunk-Search/Adding-Sparkline-based-on-eval-variable/m-p/490405#M136937 <P>I have a search which captures data from all the machines on the network and calculates OS Health of each machine (host). I am displaying it like this <BR /> OSHealth DeviceCount Percentage<BR /> 5 288 35%<BR /> 4 150 20%</P> <P>I want to add a sparkline to show the trend of changing percentage and add it like another column. I have tried alot based on splunk docs but it always show as a straight line. I would really appreciate some help. My search is attached below</P> <P>| stats count(host) AS DeviceCount by OSHealth<BR /> | eventstats sum(DeviceCount) AS SumDevice<BR /> | eval Percentage = round((DeviceCount/SumDevice)*100,1)<BR /> | stats sparkline avg(Percentage) as Trend by OSHealth DeviceCount<BR /> | table OSHealth DeviceCount Percentage</P> Mon, 04 May 2020 03:38:36 GMT https://community.splunk.com/t5/Splunk-Search/Adding-Sparkline-based-on-eval-variable/m-p/490405#M136937 itssaad14 2020-05-04T03:38:36Z https://community.splunk.com/t5/Splunk-Search/Adding-Sparkline-based-on-eval-variable/m-p/490406#M136938 <P>Sparklines require _time to work. However, the initial <CODE>stats</CODE> command is returning only the DeviceCount and OSHealth fields. </P> Mon, 04 May 2020 13:39:30 GMT https://community.splunk.com/t5/Splunk-Search/Adding-Sparkline-based-on-eval-variable/m-p/490406#M136938 richgalloway 2020-05-04T13:39:30Z