Dashboards & Visualizations

How can I generate Sparklines inside Splunk?

Yancy
Path Finder

Hi,

I'd like to create some dashboards that make use of Sparklines, so that I could explicitly track a number of key performance indicators. I've seen the Community Page that describes how to use jQuery Sparklines to bring this data outside of a Splunk 3.x instance, but it seems like this should be easier to do within the 4.x architecture. I see references to adding custom HTML & CSS in the developer documentation, but not much about adding Javascript. I'm also confused how search results could be serialized into a csv list (necessary for input into the Sparkline library). I'd probably make use of the How to use one search for a whole dashboard page as well.

Where would you start?

Tags (3)
1 Solution

twkan
Splunk Employee
Splunk Employee

Sparkline will be a new feature in the upcoming 4.3 release, in which you can use the sparkline function in your search query. An example would be:

index=_internal | chart sparkline count by sourcetype

Or you can even embed the sparkline function into your existing stats function.

sourcetype=access_combined | stats sparkline count, avg(hits) by server | sort count

If your current dashboard requirements can wait, I would suggest you hold on till 4.3 is out.

View solution in original post

bidahor13
Path Finder

Any idea on how I can create a spark line showing the latency for each virtual machine ?

0 Karma

twkan
Splunk Employee
Splunk Employee

Sparkline will be a new feature in the upcoming 4.3 release, in which you can use the sparkline function in your search query. An example would be:

index=_internal | chart sparkline count by sourcetype

Or you can even embed the sparkline function into your existing stats function.

sourcetype=access_combined | stats sparkline count, avg(hits) by server | sort count

If your current dashboard requirements can wait, I would suggest you hold on till 4.3 is out.

View solution in original post

Damien_Dallimor
Ultra Champion

These were demo'd at splunkconf as being a feature in 4.3

camilleballi
New Member

I am waiting for this to be answered also !

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!