I want to display splarkline and its corresponding bar chart in single dashboard.
(Example) sourcetype=xxx index=yyy | |stats sparkline count by branch_location_code
Here i am receiving sparkline i want also barchart. When i change the visualization to bar chart then unable to see sparkline.
Please help here.
How do you envision showing a barchart incl. sparklines? Because that stats command gives a sparkline for each branch_location_code.
Probably the easiest would be to have 2 panels. One with the total count by branch_location_code visualized in a bar chart and one that does a
sourcetype=xxx index=yyy | timechart count by branch_location_code to show the count by branch_location_code over time (just like a sparkline does).
I'm not sure it is possible at all to have a sparkline over a bar chart, one solution would be to create 2 panels on the dashboard, one displaying the bar chart and then a panel beneath displaying the sparkline, either that or you could amend the SPL slightly and utilise the Chart Overlay function to display another line over the Bar Chart... it all depends on what you want to display