Trend or sparkline

[ReachDataScient]

I have the below search which shows 3 columns....the field1, index list and events count. How can I add a trend line or a spark line to show if the event count is increasing or decreasing.

| tstats count by index
| join index type=inner
| inputlookup LookUp1
| eval index=lower(index)
| table field1,index,count
| sort field1 asc]
| stats list(index) as index, sum(count) as count by field1

[maciep]

you can add _time to the by clause in your tstats command to bucket the data over time. I'm not sure what your lookup does exactly and/or if you really need a list of indexes in the results, but maybe this will point you in the right direction

|  tstats count by index _time span=1h
.
.
.
| timechart span=1h sum(count) as count by field1