I have a 15 minute real time search creating a sparkling and it looks great when it works.
However often it looks like this, flat and i am not sure why.
I use this for the SPLUNK_HOME page so many user can log in. So i have created a savedsearch that is Real-Time
| savedsearch HOME_LIVE_EVENTS_SPARKLINE (This is a 15 minute real time search)
This is a
index=mlc_live | table host | chart sparkline count by host | fields - count (This is a 15 minute real time search)
Any ideas how to get it to work 100% of the time.
Can you please try this?
index=mlc_live | table host _time | chart sparkline count by host | fields - count
_time is required for sparkline.