Sparkline not working in 7.2.6

[robertlynch2020]

Hi

I am on version 7.1.6 and want to move to 7.2.6 but i have noticed that spark-lines don't work in the new version.

Or am i missing something?

This is the SPL

index=mlc_live  | table host  _time| chart sparkline count by host | fields - count

When i change from fast mode to verbose mode in SPL it works, but you cant save a search that way.

Any help would be great.

[jberwick_splunk]

I would try using stats/chart command first then table the results.

index=_internal | stats sparkline count by host | table host sparkline count

[niketn]

I tried the following run anywhere example in Windows machine with 7.2.6 on chrome, edge, IE and Firefox browsers and it worked fine.

<dashboard>
  <label>Sparkline</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal 
| chart sparkline count by sourcetype
| fields - count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>

[burwell]

Which mode did you test in?

[niketn]

Since this is dashboard it will not need search mode. However, I did test test with Fast Mode as well.

[burwell · Accepted solution]

Hi. I did a quick test on my Mac with 7.2.6 and I see the bug as well.

I opened a case with Splunk. I will post results here.

I also discovered it is the order of the arguments. For example the following DOES work in 7.2.6

index=_internal  | chart count
  sparkline by sourcetype  | sort -count

[burwell]

@robertlynch2020 try just removing the table line in your query.

I think your sparkline will work in all modes then.

[robertlynch2020]

Hi

From one Splunk Ninja(2017) to another(2018) - thanks very much 🙂

[AKG1_old1]

@burwell : removing table command worked !! cheers!