Dashboards & Visualizations

How to adjust dynamic timespan in sparklines?

rjdefrancisco
Explorer

I'd  love to be able to dynamically adjust the timespan in  a sparkline, as in

 

...| eval timespan=tostring(round((now()-strptime("2023-07-26T09:45:06.00","%Y-%m-%dT%H:%M:%S.%N"))/6000))+"m"
   | chart sparkline(count,timespan) as Sparkline, count by src_ip

 

However, sparklines do not accept timespans in string format, and the example above results in the following error message:

 

Error in 'chart' command: Invalid timespan specified for sparkline.

 

Any suggestions? I see that this question was asked back in 2019, but I couldn't find the answer.

Labels (1)
0 Karma
1 Solution

danspav
SplunkTrust
SplunkTrust

Hi @rjdefrancisco,


If you are using the chart in a dashboard, you could create a new search that calculates the timespan  and saves the value to a token. Then you can use the token in your main search:

<dashboard version="1.1" theme="light">
  <label>My Dashboard</label>
  <search>
    <query>|makeresults | eval timespan=tostring(round((now()-strptime("2023-07-26T09:45:06.00","%Y-%m-%dT%H:%M:%S.%N"))/6000))+"m"</query>
    <done>
      <set token="timespan">$result.timespan$</set>
    </done>
  </search>
  ....
</dashboard>

 

Then you can update your main search to use the token:

...
| chart sparkline(count,$timespan$) as Sparkline, count by src_ip
...

 

Your main search won't run until the token is calculated. If you want, you can set a default value when the dashboard loads by using an init block:

<init>
    <set token="timespan">60m</set>
</init>

 

Cheers,
Daniel

View solution in original post

0 Karma

danspav
SplunkTrust
SplunkTrust

Hi @rjdefrancisco,


If you are using the chart in a dashboard, you could create a new search that calculates the timespan  and saves the value to a token. Then you can use the token in your main search:

<dashboard version="1.1" theme="light">
  <label>My Dashboard</label>
  <search>
    <query>|makeresults | eval timespan=tostring(round((now()-strptime("2023-07-26T09:45:06.00","%Y-%m-%dT%H:%M:%S.%N"))/6000))+"m"</query>
    <done>
      <set token="timespan">$result.timespan$</set>
    </done>
  </search>
  ....
</dashboard>

 

Then you can update your main search to use the token:

...
| chart sparkline(count,$timespan$) as Sparkline, count by src_ip
...

 

Your main search won't run until the token is calculated. If you want, you can set a default value when the dashboard loads by using an init block:

<init>
    <set token="timespan">60m</set>
</init>

 

Cheers,
Daniel

0 Karma

rjdefrancisco
Explorer

Thank you, @danspav! Your proposed solution works great.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...