Dashboards & Visualizations
Highlighted

Why does the Sparkline looks flat sometimes?

Motivator

Hi

I have a 15 minute real time search creating a sparkling and it looks great when it works.

However often it looks like this, flat and i am not sure why.
alt text

I use this for the SPLUNK_HOME page so many user can log in. So i have created a savedsearch that is Real-Time

| savedsearch HOME_LIVE_EVENTS_SPARKLINE (This is a 15 minute real time search)

This is a

index=mlc_live  | table host | chart sparkline count by host | fields - count (This is a 15 minute real time search)

Any ideas how to get it to work 100% of the time.

Rob

0 Karma
Highlighted

Re: Why does the Sparkline looks flat sometimes?

SplunkTrust
SplunkTrust

@robertlynch2020

Just added _time .

Can you please try this?

index=mlc_live | table host _time | chart sparkline count by host | fields - count 

_time is required for sparkline.

Happy Splunking

View solution in original post

0 Karma
Highlighted

Re: Why does the Sparkline looks flat sometimes?

Motivator

Perfect thanks 🙂

0 Karma
Highlighted

Re: Why does the Sparkline looks flat sometimes?

SplunkTrust
SplunkTrust

Great @robertlynch2020
Can you please upvote and accept this answer to close question?

0 Karma
Highlighted

Re: Why does the Sparkline looks flat sometimes?

Motivator

Sure - sorry and thanks very much

0 Karma