Splunk sparkline showing null as 0

[xchang1226]

I am trying to display some performance metrics like cpu and memory using sparkline, the search is something like this: 'some search' | chart sparkline(avg(cpu)), but even though my data does not have any 0's in it, the sparkline shows a lot of 0's.

Is there a way to ignore null values and not show 0's in sparkline?

[xchang1226]

Thanks for the answer. You are right that sparkline does create time buckets like timechart does, but in timechart, null values are not treated as zero, if you pick line style, the line will just connect all your actual data points and skip those null values which is the way it should be. But unfortunately sparkline treats null as zero, and I can't find a way to change that.

I don't think I can find a time span that always has a value in every bucket, you are assuming the data is always coming in at the same rate which is not the case. Unless the time span is very big which then it will lose the density.

Anyone has other ideas? Thanks.

[martin_mueller]

Sparklines work a bit like timecharts, they create buckets based on a timespan. If there is no value for that bucket, whether due to no events or only events without the field, the value of the average is zero.

You can fine-tune these buckets by specifying their time span like this:

'some search' | chart sparkline(avg(cpu), 10m)

With an appropriate span length you can make sure to always have a value in the bucket to compute the average.

[martin_mueller]

To get rid of null values you can fill them with the previous value using the filldown command.