Dashboards & Visualizations

sparkline not show trends

raindrop18
Communicator

alt textI have the following query, however, the sparkline didn't show the trend instead one single value everything else is a straight line. what did I miss

   sourcetype=metrics name=http*://*   rename "data.avg_response_time_ms" as avg_response_time_sec , "data.avg_error_rate" as avg_error_rate | eval avg_response_time_sec=avg_response_time_sec/1000 | eval avg_response_sec=round(avg_response_sec,2)| stats  sparkline(avg(avg_response_time_sec),5m) as Trend by name,avg_response_time_sec ,avg_error_rate 
Tags (1)
0 Karma

HiroshiSatoh
Champion

Is it correct that avg_response_time_sec exists in ”by name, avg_response_time_sec, avg_error_rate”?

0 Karma

raindrop18
Communicator

yes. that's correct and return the data.

0 Karma

HiroshiSatoh
Champion

Is the numerical value of avg_response_time_sec rounded to 0?
0.000001 is displayed, but 0.0000001 is 0.

0 Karma

raindrop18
Communicator

I have updated with rounding to 2 decimal point but the sparkling still not changed, also attached screenshot.

0 Karma

HiroshiSatoh
Champion

The screen image and the search sentence do not match.
Please upload the correct search sentence again. Also please tell me the extraction period.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...