Dashboards & Visualizations

Sparklines very narrow - but not for all time periods

phildotleeatanz
Explorer

Hi there,

Any ideas why sparklines would be so short/narrow? I'm seeing that for shorter time windows - e.g. less than 4 days - the sparkline shows as expected. But once I extend it to a longer window the sparklines are very compressed.

alt text

Is that a common issue?

Thanks,
Phil

DavidHourani
Super Champion

Hi @phildotleeatanzdotcom,

How many data points are you getting for 7d, you could be hitting the limit of points that you can plot (10000) - as shown here https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference#General_chart_pr... under charting.data.count. EDIT: This applies to timecharts and not sparklines...apparently sparklines are limited to around 100 points.

I advise you to use a bigger time span when going for 7d to allow for the sparkline to be displayed. You can test this by changing your span to 1d and looking at the 7d sparkline, should be working as you need it to.

Let me know if that helps.

Cheers,
David

0 Karma

phildotleeatanz
Explorer

Thanks @DavidHourani - that could be it, although the sample size is every 30 minutes, so I would have thought that 7 days would only have had 7*48=336 data points. the base
e.g.

<search base="baseSearch">
       <!-- Group the events into 30 min block so we can get some realistic averages for success/failure percentage. If we use a shorter duration, the numbers fluctuate too much -->
       <query>
         <![CDATA[
         | bin _time minspan=30m 
         | stats sum(success_count) as success_count sum(partial_count) as partial_count sum(failure_count) as failure_count sum(count) as count avg(avg_duration) as avg_duration by _time, SERVICE 
         | eval success_rate=((success_count/count)*100) 
         | stats sparkline(avg(success_rate)) as "Success Rate Trend" avg(success_rate) as "Success Rate Avg" first(success_rate) as "Success Rate Last" sum(success_count) as success_count sum(partial_count) as partial_count sum(failure_count) as failure_count sum(count) as count avg(avg_duration) as "Avg Duration" sparkline(avg(avg_duration)) as "Avg Duration Trend"  by SERVICE 
         | sort "Success Rate Avg"
         ]]>
       </query>
     </search>

If I want it to dynamically modify the span based on the selected time window, is there an easy way to do that within the query? Currently I have a time picker on the page and run the base query based on the values in there, so I have access to variables for $time_token.earliest$ and $time_token.latest$

Thanks,
Phil

0 Karma

DavidHourani
Super Champion

Hi Phil,

So I double checked and edited my answer above. The 10k limit is for standard charting, when it comes to sparklines its 100 points max.

To workaround that you can replace the | bin _time minspan=30m by | bin _time bins=100 this will ensure you only have a maximum of 100 points regardless of the chosen time period. So whichever time you pick from the timepicker your sparkline should look just like you need it to.

Let me know if that helps.

Cheers,
David

0 Karma

phildotleeatanz
Explorer

Thanks @DavidHourani. I tried but that still shows them as very short as soon as it goes above 3 days?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...