Hi,
I would like to change the sparkline chunk based on the time range.
I calculate the time and put it in span, which is used in the sparkline command. Looks like the value of it is a string and it is not supported.
Could you please advise how to fix this, or what is the best practice? What I want to do is to set the chunks accordingly based on the search time range. Thanks.
index = windesktop_log sourcetype = "WinEventLog:Application"
| rename Message AS MainMessage
| spath input=MainMessage
| addinfo
| eval timerange= info_max_time-info_min_time
| eval span=case(timerange<4000,"1m",timerange<172800,"1h",1=1,"1d")
| stats sparkline(avg(ResolveTime),span) as resolve_time_trend count, avg(ResolveTime) by ResolveType
| sort - count
