How do I rehydrate a sparkline from a lookup?

MonkeyK — Sat, 18 Mar 2023 12:33:03 GMT

Sometimes I run a really complex query and accumulate results in a lookup table. I recently tried doing this and including a sparkline, which gave me a field that looked like

trend

##__SPARKLINE__##,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,63,55,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0

If I just run "|inputlookup" to visualize that data, I just get the raw data back. Is there a command that turns the stored sparkline data back into a sparkline?

Re: How do I rehydrate a sparkline from a lookup?

ITWhisperer — Sat, 18 Mar 2023 13:35:06 GMT

Try this

| eval trend=split(trend,",")

Re: How do I rehydrate a sparkline from a lookup?

MonkeyK — Sat, 18 Mar 2023 15:40:19 GMT

works great! thanks!

topic How do I rehydrate a sparkline from a lookup? in Splunk Search

How do I rehydrate a sparkline from a lookup?

Re: How do I rehydrate a sparkline from a lookup?

Re: How do I rehydrate a sparkline from a lookup?