Hi
Trying to display some data with single value (and sparkline) with the single value viz.
I want to break the result up over "countries", but nothing comes out.
I get a sparkline, but the rest are all zero's
| gentimes start=01/01/2024 end=01/31/2024 increment=1d
| eval _time=starttime
| eval countries="Sweden,Finland,Estonia,Lithuania,Norway,Latvia"
| makemv delim="," countries
| mvexpand countries
| eval value=round(random() % 100, 0)
| streamstats count
| sort countries
| timechart span=1d avg(value) by countries
Dashboard
Cracked it 😊
| gentimes start=12/01/2024 end=-1 increment=1d
| eval _time=starttime
| eval countries="Sweden,Finland,Estonia,Lithuania,Norway,Latvia"
| makemv delim="," countries
| mvexpand countries
| eval value=round(random() % 100, 0)
| timechart max(value) by countries
Cracked it 😊
| gentimes start=12/01/2024 end=-1 increment=1d
| eval _time=starttime
| eval countries="Sweden,Finland,Estonia,Lithuania,Norway,Latvia"
| makemv delim="," countries
| mvexpand countries
| eval value=round(random() % 100, 0)
| timechart max(value) by countries
@uthornander_spl- Kindly please accept your own answer, so future Splunk Community users gets benefited from it.