topic Re: Sparkline in Join in Splunk Search

Sparkline in Join

takashi6 — Mon, 15 Aug 2016 03:09:59 GMT

Hi expert,

I'm trying to use sparkline inside join subsearch.
The result out of the sparkline is not rendered properly and looks like this:
(##SPARKLINE##,514.000000,549.000000,608.000000,665.000000,729.000000,786.000000,853....... data continues)

I looked up this previous post where a solution was suggested, but it doesn't work in my case.
https://answers.splunk.com/answers/69290/appending-sparkline-through-a-join.html

Is there a command I can use to render the result correctly?

I've tried "append" and "appendcols" instead of "join", both of which render correctly, but:
- "append" doesn't map the sparklines to the correct rows
- "appendcols" adds new rows for the sparklines and doesn't map sparklines next to the existing rows.

Any suggestion would be much appreciated!

Re: Sparkline in Join

lguinn2 — Wed, 17 Aug 2016 23:20:19 GMT

What is the entire search string? Otherwise we are just guessing...

Re: Sparkline in Join

takashi6 — Tue, 29 Sep 2020 10:39:18 GMT

Hi Iguinn - thanks for picking this up.

The below is the sparkline query which works perfectly when run independently:

index=foo type=Pending
| chart sparkline(avg(open_order),15m) as "Pending Trend" by service_name | sort service_name

The below is the sparkline query within the join which returns the result not rendered as a "sparkline" format - as you can see I'm (1) listing all the possible service_name, (2) appending pending count for those services which had a pending count in the latest data extraction, (3) appending pending count trend in a sparkline format. (1) and (2) works but (3) returns non-rendered result.

Re: Sparkline in Join

takashi6 — Tue, 23 Aug 2016 03:32:56 GMT

Hi Iguinn - was the information I provided helpful/enough? appreciate if you could provide your feedback.

Re: Sparkline in Join

takashi6 — Tue, 30 Aug 2016 05:22:38 GMT

Hi Iguinn or any expert - appreciate your feedback...

Re: Sparkline in Join

gergelybata — Thu, 29 Jun 2017 14:31:14 GMT

Hi,

If it's still a concern... Run into the same issue and this solution worked:

| join ... [.... sparkline(...) as sparkvisual ... ] | makemv delim="," setsv=true sparkvisual

Credit goes to this topic:
https://answers.splunk.com/answers/69290/appending-sparkline-through-a-join.html

Re: Sparkline in Join

oolatunji — Tue, 04 Dec 2018 18:36:12 GMT

use appendcols instead of Join