I have a saved search "MY_SEARCH_1H" defined as follows
action.summary_index = 1
action.summary_index.reporttime = hourly
action.summary_index.reporttype = myperf
action.summary_index._name = mysummary
cron_schedule = 30 * * * *
dispatch.earliest_time = -1h@h
dispatch.latest_time = @h
enableSched = 1
search = index="app" sourcetype="my_service" | rename sourcetype as AppSourceType | fillnull value=na | sistats count(OperationName) as Count, exactperc99.9(Duration) as TP99.9, exactperc99(Duration) as TP99, exactperc95(Duration) as TP95, exactperc90(Duration) as TP90, exactperc50(Duration) as TP50,min(Duration) as Min, avg(Duration) as Avg , max(Duration) as Max by AppSourceType,ActivityName,OperationName,ActivityStep
disabled = 0
I am trying to build a chart using the following :
index=mysummary search_name="MY_SEARCH_1H" | chart min(Duration) as Min, avg(Duration) as Avg , max(Duration) as Max,exactperc99(Duration) as TP99,sparkline(avg(Duration),1h) as spark by OperationName
Everything works fine except the sparkline does not display.
Instead if I do this:
index=app sourcetype=my_service |chart min(Duration) as Min, avg(Duration) as Avg , max(Duration) as Max,exactperc99(Duration) as TP99,sparkline(avg(Duration),1h) as spark by OperationName
everything works fine and the sparkline is visible.
Any idea as to how I can fix this?
