topic Re: Appending Sparkline through a JOIN in Splunk Search

Appending Sparkline through a JOIN

Drainy — Fri, 14 Dec 2012 09:29:53 GMT

Good morning!

I'm about to dive into the JS on this to discover how its rendered but in the meantime I thought I'd throw it out here to see if anyone else has come across this..

Imagine a pretty basic search, all I'm doing is pulling back blocked events, no transactions or any funny business.. then I have a brainwave and decide to append a sparkline of blocked events for the same queue. This way I get a timestamp of the most recent block event with a mini timeline of previous blockages...

However, the sparkline is generated in a subsearch (within a join command) and when its passed back it isn't being rendered as a sparkline but instead as the markup for it.

Screenshot below, if anyone has come across this I'd be interested to know, otherwise I guess its just a bug/limitation of sparkline at the moment.

EDIT: Its worth pointing out that this does work if you reverse it and generate the sparkline first and then append the _time, but I'm interested in the problem now 🙂

Re: Appending Sparkline through a JOIN

dmr195 — Tue, 18 Dec 2012 13:32:13 GMT

I saw a different situation where a sparkline was being displayed as its text markup rather than as a graphic. In my case it turned out that the sparkline field had ceased to be a multi-valued field. You can make it multi-valued again by appending this to the end of your search (or at least after the join):

| makemv delim="," setsv=true sparkline

As I said, the situation where I saw the problem was completely different to yours, so maybe this won't solve your case, but it worked for me.

Re: Appending Sparkline through a JOIN

hazekamp — Tue, 12 Feb 2013 21:05:29 GMT

This did work to correct the sparkline rendering for my search that involved "| join"

Re: Appending Sparkline through a JOIN

abchernin — Wed, 06 Mar 2013 12:26:21 GMT

Situation same as on OP's screenshot -- after join of savedsearch with sparklines, got a column of raw data. Solution worked.

Re: Appending Sparkline through a JOIN

jrodriguezap — Tue, 06 Aug 2013 21:54:20 GMT

Very good.
I ran to my well.
Thank you very much!

Re: Appending Sparkline through a JOIN

troybebee — Tue, 15 Jul 2014 02:45:50 GMT

Works great. Thanks!

Re: Appending Sparkline through a JOIN

mschellhouse — Mon, 11 Jun 2018 11:02:56 GMT

We just upgraded to 7.x. It appears that they resolved the rendering issue as I no longer need to use the |makev * solution.

Re: Appending Sparkline through a JOIN

the0duke0 — Fri, 22 Jun 2018 14:34:16 GMT

For us it seems 7.1 has broken the |makemv solution, and removing it doesn't help. I cannot get the sparkline to render if it is in the second part of the join. I was able to work around it by switching the order and having the sparkline before the join.

Re: Appending Sparkline through a JOIN

swaro_ck — Mon, 25 Jun 2018 09:26:47 GMT

Same problem here with Splunk 7.1.1

Re: Appending Sparkline through a JOIN

andymcdowall — Mon, 27 Aug 2018 20:42:26 GMT

I had the same issue in 7.1.2, removing setsv=true fixed it for me

Re: Appending Sparkline through a JOIN

ktvrznik — Thu, 13 Dec 2018 13:15:36 GMT

I can confirm that if you remove setsv=true it will fix this issue