Dashboards & Visualizations

Trend or sparkline

ReachDataScient
Explorer

I have the below search which shows 3 columns....the field1, index list and events count. How can I add a trend line or a spark line to show if the event count is increasing or decreasing.

| tstats count by index
| join index type=inner
| inputlookup LookUp1
| eval index=lower(index)
| table field1,index,count
| sort field1 asc]
| stats list(index) as index, sum(count) as count by field1

Tags (1)
0 Karma

maciep
Champion

you can add _time to the by clause in your tstats command to bucket the data over time. I'm not sure what your lookup does exactly and/or if you really need a list of indexes in the results, but maybe this will point you in the right direction

|  tstats count by index _time span=1h
.
.
.
| timechart span=1h sum(count) as count by field1
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...