Dashboards & Visualizations

How to adjust dynamic timespan in sparklines?

rjdefrancisco
Explorer

I'd  love to be able to dynamically adjust the timespan in  a sparkline, as in

 

...| eval timespan=tostring(round((now()-strptime("2023-07-26T09:45:06.00","%Y-%m-%dT%H:%M:%S.%N"))/6000))+"m"
   | chart sparkline(count,timespan) as Sparkline, count by src_ip

 

However, sparklines do not accept timespans in string format, and the example above results in the following error message:

 

Error in 'chart' command: Invalid timespan specified for sparkline.

 

Any suggestions? I see that this question was asked back in 2019, but I couldn't find the answer.

Labels (1)
0 Karma
1 Solution

danspav
SplunkTrust
SplunkTrust

Hi @rjdefrancisco,


If you are using the chart in a dashboard, you could create a new search that calculates the timespan  and saves the value to a token. Then you can use the token in your main search:

<dashboard version="1.1" theme="light">
  <label>My Dashboard</label>
  <search>
    <query>|makeresults | eval timespan=tostring(round((now()-strptime("2023-07-26T09:45:06.00","%Y-%m-%dT%H:%M:%S.%N"))/6000))+"m"</query>
    <done>
      <set token="timespan">$result.timespan$</set>
    </done>
  </search>
  ....
</dashboard>

 

Then you can update your main search to use the token:

...
| chart sparkline(count,$timespan$) as Sparkline, count by src_ip
...

 

Your main search won't run until the token is calculated. If you want, you can set a default value when the dashboard loads by using an init block:

<init>
    <set token="timespan">60m</set>
</init>

 

Cheers,
Daniel

View solution in original post

0 Karma

danspav
SplunkTrust
SplunkTrust

Hi @rjdefrancisco,


If you are using the chart in a dashboard, you could create a new search that calculates the timespan  and saves the value to a token. Then you can use the token in your main search:

<dashboard version="1.1" theme="light">
  <label>My Dashboard</label>
  <search>
    <query>|makeresults | eval timespan=tostring(round((now()-strptime("2023-07-26T09:45:06.00","%Y-%m-%dT%H:%M:%S.%N"))/6000))+"m"</query>
    <done>
      <set token="timespan">$result.timespan$</set>
    </done>
  </search>
  ....
</dashboard>

 

Then you can update your main search to use the token:

...
| chart sparkline(count,$timespan$) as Sparkline, count by src_ip
...

 

Your main search won't run until the token is calculated. If you want, you can set a default value when the dashboard loads by using an init block:

<init>
    <set token="timespan">60m</set>
</init>

 

Cheers,
Daniel

0 Karma

rjdefrancisco
Explorer

Thank you, @danspav! Your proposed solution works great.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...