Your help is much appreciated.
Can get the following table
sourcetype="test_data" | table monitor1, monitor2, monitor3
monitor1, monitor2, monitor3
0, 1, 1
0, 0, 0
1, 1, 1
However would like the following
column1, column2, column3
monitor1, sparkline, 0
monitor2, sparkline, 1
monitor3, sparkline, 1
where column1 is the monitor name, column2 is sparkline of the values and column3 is the first top row
I think the best way would be to untable on the results and then use stats
E.g.
Search
| streamstats count
| eval _time=now()+count*10
| untable _time field value
| stats sparkling(value), latest(value) by field
I think the best way would be to untable on the results and then use stats
E.g.
Search
| streamstats count
| eval _time=now()+count*10
| untable _time field value
| stats sparkling(value), latest(value) by field
Something like this?
index=_internal | stats sparkline(avg(date_second)) as s1 latest(date_second) as l1 sparkline(avg(date_minute)) as s2 latest(date_minute) as l2 sparkline(avg(date_hour)) as s3 latest(date_hour) as l3 | eval column1 = "monitor1 monitor2 monitor3" | makemv column1 | mvexpand column1 | eval column2 = case(column1=="monitor1",s1,column1=="monitor2",s2,column1=="monitor3",s3) | eval column3 = case(column1=="monitor1",l1,column1=="monitor2",l2,column1=="monitor3",l3) | fields column*
It'd be a bit less cumbersome to produce the desired result if you had events like this:
timestamp monitor="monitor1" value=1
timestamp monitor="monitor2" value=0
timestamp monitor="monitor2" value=1
Rather than this:
timestamp monitor1=1 monitor2=0 monitor3=1
Then you could add do something like this:
your base search | stats sparkline(avg(value)) latest(value) by monitor
Much more concise and flexible that way, depends on what your data actually looks like.