Dashboards & Visualizations

sparkline not show trends

raindrop18
Communicator

alt textI have the following query, however, the sparkline didn't show the trend instead one single value everything else is a straight line. what did I miss

   sourcetype=metrics name=http*://*   rename "data.avg_response_time_ms" as avg_response_time_sec , "data.avg_error_rate" as avg_error_rate | eval avg_response_time_sec=avg_response_time_sec/1000 | eval avg_response_sec=round(avg_response_sec,2)| stats  sparkline(avg(avg_response_time_sec),5m) as Trend by name,avg_response_time_sec ,avg_error_rate 
Tags (1)
0 Karma

HiroshiSatoh
Champion

Is it correct that avg_response_time_sec exists in ”by name, avg_response_time_sec, avg_error_rate”?

0 Karma

raindrop18
Communicator

yes. that's correct and return the data.

0 Karma

HiroshiSatoh
Champion

Is the numerical value of avg_response_time_sec rounded to 0?
0.000001 is displayed, but 0.0000001 is 0.

0 Karma

raindrop18
Communicator

I have updated with rounding to 2 decimal point but the sparkling still not changed, also attached screenshot.

0 Karma

HiroshiSatoh
Champion

The screen image and the search sentence do not match.
Please upload the correct search sentence again. Also please tell me the extraction period.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...