I have the following query, however, the sparkline didn't show the trend instead one single value everything else is a straight line. what did I miss
sourcetype=metrics name=http*://* rename "data.avg_response_time_ms" as avg_response_time_sec , "data.avg_error_rate" as avg_error_rate | eval avg_response_time_sec=avg_response_time_sec/1000 | eval avg_response_sec=round(avg_response_sec,2)| stats sparkline(avg(avg_response_time_sec),5m) as Trend by name,avg_response_time_sec ,avg_error_rate
Is it correct that avg_response_time_sec exists in ”by name, avg_response_time_sec, avg_error_rate”?
yes. that's correct and return the data.
Is the numerical value of avg_response_time_sec rounded to 0?
0.000001 is displayed, but 0.0000001 is 0.
I have updated with rounding to 2 decimal point but the sparkling still not changed, also attached screenshot.
The screen image and the search sentence do not match.
Please upload the correct search sentence again. Also please tell me the extraction period.