Why is sparkline returning '0' or '1'?

[lennys26]

I have a query that returns an avg calculation over time and I am using a sparkline to try to show the results for each 'period' over that time, however although my results are showing a correct value, my sparkline only shows a value of 0 or 1.

My search is:

| tstats SUM(ABC) as ABC, sum(DEF) as DEF where index=FOO earliest=-4h latest=-45m by _time platform span=5m 
| eval AVG_ABC=((sum(DEF)/sum(ABC))/60) 
| stats sparkline avg(AVG_ABC) by platform

Instead of the single line result with the sparkline over time, I get the following:

Can anyone point me in the right direction? Essentially I am looking to create something like a single number value viz with a trendline.

Thanks.

[ITWhisperer]

Try this since you have already renamed sum(DEF) as DEF and sum(ABC) as ABC

| eval AVG_ABC=(DEF/ABC)/60 

[lennys26]

Hi@ITWhisperer. Bad SPL on my side (or perhaps i just foobar'ed by code when I was replacing all of the FOOs and BARs in my post 😁), but either way, thanks for the correction.

Anyhow, I have made the change, but this does not affect the end result.

[ITWhisperer · Accepted solution]

| tstats SUM(ABC) as ABC, sum(DEF) as DEF where index=FOO earliest=-4h latest=-45m by _time platform span=5m 
| eval AVG_ABC=(DEF/ABC)/60 
| stats sparkline(avg(AVG_ABC)) by platform

[lennys26]

Ahh haa! I had spaces between the 'sparkline' and the function: 

| stats sparkline avg(AVG_LOC) by platform

instead of

| stats sparkline(avg(AVG_LOC)) by platform

The strange thing is that my notes show that I have used this with the space in the past. Either way, it is working now.

Thanks.