I have a query that returns an avg calculation over time and I am using a sparkline to try to show the results for each 'period' over that time, however although my results are showing a correct value, my sparkline only shows a value of 0 or 1.
My search is:
| tstats SUM(ABC) as ABC, sum(DEF) as DEF where index=FOO earliest=-4h latest=-45m by _time platform span=5m
| eval AVG_ABC=((sum(DEF)/sum(ABC))/60)
| stats sparkline avg(AVG_ABC) by platform
Instead of the single line result with the sparkline over time, I get the following:
Can anyone point me in the right direction? Essentially I am looking to create something like a single number value viz with a trendline.
Thanks.
| tstats SUM(ABC) as ABC, sum(DEF) as DEF where index=FOO earliest=-4h latest=-45m by _time platform span=5m
| eval AVG_ABC=(DEF/ABC)/60
| stats sparkline(avg(AVG_ABC)) by platform
Try this since you have already renamed sum(DEF) as DEF and sum(ABC) as ABC
| eval AVG_ABC=(DEF/ABC)/60
Hi@ITWhisperer. Bad SPL on my side (or perhaps i just foobar'ed by code when I was replacing all of the FOOs and BARs in my post 😁), but either way, thanks for the correction.
Anyhow, I have made the change, but this does not affect the end result.
| tstats SUM(ABC) as ABC, sum(DEF) as DEF where index=FOO earliest=-4h latest=-45m by _time platform span=5m
| eval AVG_ABC=(DEF/ABC)/60
| stats sparkline(avg(AVG_ABC)) by platform
Ahh haa! I had spaces between the 'sparkline' and the function:
| stats sparkline avg(AVG_LOC) by platform
instead of
| stats sparkline(avg(AVG_LOC)) by platform
The strange thing is that my notes show that I have used this with the space in the past. Either way, it is working now.
Thanks.