Dashboards & Visualizations

How to adjust dynamic timespan in sparklines?

rjdefrancisco
Explorer

I'd  love to be able to dynamically adjust the timespan in  a sparkline, as in

 

...| eval timespan=tostring(round((now()-strptime("2023-07-26T09:45:06.00","%Y-%m-%dT%H:%M:%S.%N"))/6000))+"m"
   | chart sparkline(count,timespan) as Sparkline, count by src_ip

 

However, sparklines do not accept timespans in string format, and the example above results in the following error message:

 

Error in 'chart' command: Invalid timespan specified for sparkline.

 

Any suggestions? I see that this question was asked back in 2019, but I couldn't find the answer.

Labels (1)
0 Karma
1 Solution

danspav
SplunkTrust
SplunkTrust

Hi @rjdefrancisco,


If you are using the chart in a dashboard, you could create a new search that calculates the timespan  and saves the value to a token. Then you can use the token in your main search:

<dashboard version="1.1" theme="light">
  <label>My Dashboard</label>
  <search>
    <query>|makeresults | eval timespan=tostring(round((now()-strptime("2023-07-26T09:45:06.00","%Y-%m-%dT%H:%M:%S.%N"))/6000))+"m"</query>
    <done>
      <set token="timespan">$result.timespan$</set>
    </done>
  </search>
  ....
</dashboard>

 

Then you can update your main search to use the token:

...
| chart sparkline(count,$timespan$) as Sparkline, count by src_ip
...

 

Your main search won't run until the token is calculated. If you want, you can set a default value when the dashboard loads by using an init block:

<init>
    <set token="timespan">60m</set>
</init>

 

Cheers,
Daniel

View solution in original post

0 Karma

danspav
SplunkTrust
SplunkTrust

Hi @rjdefrancisco,


If you are using the chart in a dashboard, you could create a new search that calculates the timespan  and saves the value to a token. Then you can use the token in your main search:

<dashboard version="1.1" theme="light">
  <label>My Dashboard</label>
  <search>
    <query>|makeresults | eval timespan=tostring(round((now()-strptime("2023-07-26T09:45:06.00","%Y-%m-%dT%H:%M:%S.%N"))/6000))+"m"</query>
    <done>
      <set token="timespan">$result.timespan$</set>
    </done>
  </search>
  ....
</dashboard>

 

Then you can update your main search to use the token:

...
| chart sparkline(count,$timespan$) as Sparkline, count by src_ip
...

 

Your main search won't run until the token is calculated. If you want, you can set a default value when the dashboard loads by using an init block:

<init>
    <set token="timespan">60m</set>
</init>

 

Cheers,
Daniel

0 Karma

rjdefrancisco
Explorer

Thank you, @danspav! Your proposed solution works great.

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...