Dashboards & Visualizations

sparkline not show trends

raindrop18
Communicator

alt textI have the following query, however, the sparkline didn't show the trend instead one single value everything else is a straight line. what did I miss

   sourcetype=metrics name=http*://*   rename "data.avg_response_time_ms" as avg_response_time_sec , "data.avg_error_rate" as avg_error_rate | eval avg_response_time_sec=avg_response_time_sec/1000 | eval avg_response_sec=round(avg_response_sec,2)| stats  sparkline(avg(avg_response_time_sec),5m) as Trend by name,avg_response_time_sec ,avg_error_rate 
Tags (1)
0 Karma

HiroshiSatoh
Champion

Is it correct that avg_response_time_sec exists in ”by name, avg_response_time_sec, avg_error_rate”?

0 Karma

raindrop18
Communicator

yes. that's correct and return the data.

0 Karma

HiroshiSatoh
Champion

Is the numerical value of avg_response_time_sec rounded to 0?
0.000001 is displayed, but 0.0000001 is 0.

0 Karma

raindrop18
Communicator

I have updated with rounding to 2 decimal point but the sparkling still not changed, also attached screenshot.

0 Karma

HiroshiSatoh
Champion

The screen image and the search sentence do not match.
Please upload the correct search sentence again. Also please tell me the extraction period.

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...