Help required to add sparkline to table/stats

[peterchenadded]

Your help is much appreciated.

Can get the following table

sourcetype="test_data" | table monitor1, monitor2, monitor3

monitor1, monitor2, monitor3
0, 1, 1
0, 0, 0
1, 1, 1

However would like the following

column1, column2, column3
monitor1, sparkline, 0
monitor2, sparkline, 1
monitor3, sparkline, 1

where column1 is the monitor name, column2 is sparkline of the values and column3 is the first top row

[peterchenadded · Accepted solution]

I think the best way would be to untable on the results and then use stats

E.g.

Search
| streamstats count
| eval _time=now()+count*10
| untable _time field value
| stats sparkling(value), latest(value) by field

[martin_mueller]

Something like this?

index=_internal | stats sparkline(avg(date_second)) as s1 latest(date_second) as l1 sparkline(avg(date_minute)) as s2 latest(date_minute) as l2 sparkline(avg(date_hour)) as s3 latest(date_hour) as l3 | eval column1 = "monitor1 monitor2 monitor3" | makemv column1 | mvexpand column1 | eval column2 = case(column1=="monitor1",s1,column1=="monitor2",s2,column1=="monitor3",s3) | eval column3 = case(column1=="monitor1",l1,column1=="monitor2",l2,column1=="monitor3",l3) | fields column*

It'd be a bit less cumbersome to produce the desired result if you had events like this:

timestamp monitor="monitor1" value=1
timestamp monitor="monitor2" value=0
timestamp monitor="monitor2" value=1

Rather than this:

timestamp monitor1=1 monitor2=0 monitor3=1

Then you could add do something like this:

your base search | stats sparkline(avg(value)) latest(value) by monitor

Much more concise and flexible that way, depends on what your data actually looks like.