The format of the weekly summary is like below. Basically I just wanna show the number of alerts for the last week and a column that shows the trend (total alerts of each week) for each week.
index sparkline total_alert
usage -----/ \------- 1
I tried the following search and I was hoping the Splunk can make a sparkline based on three values (wk44: 0, wk45: 12, wk46: 1) so that when I review the data for the most recent week, I can also see the history trend, unfortunately the sparkline doesn't work as I expected (spike in the middle). In the beginning I tried sparkline(ttl_alert), it doesn't work either.
| stats sum(num_of_alert) AS ttl_alert by index week | stats sparkline(sum(ttl_alert)) last(ttl_alert) by index