Why does the Sparkline looks flat sometimes?

[robertlynch2020]

Hi

I have a 15 minute real time search creating a sparkling and it looks great when it works.

However often it looks like this, flat and i am not sure why.

I use this for the SPLUNK_HOME page so many user can log in. So i have created a savedsearch that is Real-Time

| savedsearch HOME_LIVE_EVENTS_SPARKLINE (This is a 15 minute real time search)

This is a

index=mlc_live  | table host | chart sparkline count by host | fields - count (This is a 15 minute real time search)

Any ideas how to get it to work 100% of the time.

Rob

[kamlesh_vaghela · Accepted solution]

@robertlynch2020

Just added _time .

Can you please try this?

index=mlc_live | table host _time | chart sparkline count by host | fields - count 

_time is required for sparkline.

Happy Splunking

[robertlynch2020]

Perfect thanks 🙂

[kamlesh_vaghela]

Great @robertlynch2020
Can you please upvote and accept this answer to close question?

[robertlynch2020]

Sure - sorry and thanks very much