Dashboards & Visualizations

format sparkine as bar for multiple sparkine

k_harini
Communicator

I'm facing issue with formatting sparkine as bar chart for multiple sparklines
index=xxx counter="% Idle time" OR counter="% User Time" |stats sparkline(avg(Value),1h) as Trend avg(Value) as "Avg_Value" by host counter|eval Avg_Value=round(Avg_Value,2)."%"|xyseries host counter "Avg_Value" Trend

I could see sparkline trend values as "Trend:% Idle time" "Trend:% User Time". How to specify this in format tag
Tried this

   <code>
    <format field= "Trend:% Idle time"  type="sparkline">
     <option name="type">bar</option>
   </format>
   </code>

This is not working.. can someone please help

Tags (1)
0 Karma
1 Solution

k_harini
Communicator

This is resolved. I could rename and give in different format tags. Thanks..

View solution in original post

0 Karma

k_harini
Communicator

This is resolved. I could rename and give in different format tags. Thanks..

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...