How to adjust dynamic timespan in sparklines?

[rjdefrancisco]

I'd  love to be able to dynamically adjust the timespan in  a sparkline, as in

...| eval timespan=tostring(round((now()-strptime("2023-07-26T09:45:06.00","%Y-%m-%dT%H:%M:%S.%N"))/6000))+"m"
   | chart sparkline(count,timespan) as Sparkline, count by src_ip

However, sparklines do not accept timespans in string format, and the example above results in the following error message:

Error in 'chart' command: Invalid timespan specified for sparkline.

Any suggestions? I see that this question was asked back in 2019, but I couldn't find the answer.

[danspav · Accepted solution]

Hi @rjdefrancisco,

If you are using the chart in a dashboard, you could create a new search that calculates the timespan  and saves the value to a token. Then you can use the token in your main search:

<dashboard version="1.1" theme="light">
  <label>My Dashboard</label>
  <search>
    <query>|makeresults | eval timespan=tostring(round((now()-strptime("2023-07-26T09:45:06.00","%Y-%m-%dT%H:%M:%S.%N"))/6000))+"m"</query>
    <done>
      <set token="timespan">$result.timespan$</set>
    </done>
  </search>
  ....
</dashboard>

Then you can update your main search to use the token:

...
| chart sparkline(count,$timespan$) as Sparkline, count by src_ip
...

Your main search won't run until the token is calculated. If you want, you can set a default value when the dashboard loads by using an init block:

<init>
    <set token="timespan">60m</set>
</init>

Cheers,
Daniel

[rjdefrancisco]

Thank you, @danspav! Your proposed solution works great.