All Apps and Add-ons

I'm trying to convert this search to use accelerated data from a data model.

jaywilwk
Engager

index=dns | chart sparkline AS Activity count AS "Number Transaction" by host | sort 10 -"Number Transaction" | rename host AS "Server IP"

This is what I have come up with so far...
| tstats summariesonly=t prestats=t count from datamodel=Network_Resolution by host | chart sparkline AS Activity count AS "Number Transaction" by host | sort 10 -"Number Transaction" | rename host AS "Server IP"

With this search everything works fine except for my sparkline.

0 Karma

tskinnerivsec
Contributor

I recently had to do the same thing and here is what I had to do to get it to work. The two main things that you are missing here is that sparkline is dependent on _time and I have also noticed that to work with the tstats data model searches, I've also needed to manually specify span=. So, this worked for me:

Top DNS Servers

| tstats summariesonly=t allow_old_summaries=t count(DNS.query_count) as "Number of Transactions" from datamodel=Network_Resolution groupby host _time span=1s | rename host AS "Server IP" | stats sparkline count by "Server IP" | rename sparkline as Activity count as "Number of Transactions" | sort 10 - "Number of Transactions"

Hope this helps

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...