Using Sparkline to show successful logins

[cburr2012]

Hello all,

I am wanting to build a panel in my Dashboard that allows me to see a small sample of the login trends of users.

I think a Sparkline would be a good method to use, based on its compact size and trend-viewing capability.

I've been tinkering around with Sparkline but can't quite get what I'm looking for. I liked the example Splunk Documentation gave of having the magnitudes of the Earthquakes, I feel like my solution should be easier than that. Alas, I am stuck.

My query asks: search this_index this_sourcetype logon_message etc.etc. | stats count by Account_Name | sort count

This shows me my account_names with the highest number of successful logins. Now I'd like to see that in a Sparkline over a short period of time.

Thoughts? Thanks!

[sdaniels · Accepted solution]

If you do '... | chart sparkline count by Account_Name' is it not giving you what you want?

You can use time modifiers like 'earliest' and 'latest' to specify a time period for your saved search.

http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/SearchTimeModifiers

[cburr2012]

http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/SearchTimeModifiers provided the proper documentation I needed. Thanks sdaniels.