I'm trying to convert this search to use accelerated data from a data model.

[jaywilwk]

index=dns | chart sparkline AS Activity count AS "Number Transaction" by host | sort 10 -"Number Transaction" | rename host AS "Server IP"

This is what I have come up with so far...
| tstats summariesonly=t prestats=t count from datamodel=Network_Resolution by host | chart sparkline AS Activity count AS "Number Transaction" by host | sort 10 -"Number Transaction" | rename host AS "Server IP"

With this search everything works fine except for my sparkline.

[tskinnerivsec]

I recently had to do the same thing and here is what I had to do to get it to work. The two main things that you are missing here is that sparkline is dependent on _time and I have also noticed that to work with the tstats data model searches, I've also needed to manually specify span=. So, this worked for me:

Top DNS Servers

| tstats summariesonly=t allow_old_summaries=t count(DNS.query_count) as "Number of Transactions" from datamodel=Network_Resolution groupby host _time span=1s | rename host AS "Server IP" | stats sparkline count by "Server IP" | rename sparkline as Activity count as "Number of Transactions" | sort 10 - "Number of Transactions"

Hope this helps