Add sparklines to a table for ingestion

[scout29]

I am trying to create a table showing the ingestion (usage) in GB by index over the past 24 hours. I am using this search to do that successfully: 

index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" type=Usage idx=* | stats sum(b) as Usage by idx
| eval Usage=round(Usage/1024/1024/1024,2) | rename idx AS index | sort -Usage

Now i would like to add a sparkline next to the Usage column showing the trend of ingestion over the past 7 days for each index. How can i do this ?

[gcusello]

Hi @scout29 ,

read this

https://docs.splunk.com/Documentation/Splunk/9.2.2/Search/Addsparklinestosearchresults

otherwise you could use timechart instead stats.

ciao.

Giuseppe

[scout29]

Yes i have already read this but cannot seem to get it to work. Can you please show me what exactly needs to be added to my search to get it to work?  

Below is what i have, but it does not show the trended sparkline when i run this for the past 7 days:

index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" type=Usage idx=* | stats sum(b) as Usage by idx
| eval Usage=round(Usage/1024/1024/1024,2) | rename idx AS index
| stats sparkline count, avg(usage) by index | sort Usage

[bowesmana · Accepted solution]

sparkline requires the _time field to work, so in your case, you have two stats commands, so the _time field is lost after your first stats.

You can do this

index=_internal source="/opt/splunk/var/log/splunk/license_usage.log" type=Usage idx=* 
| stats sparkline(sum(b)) as trend sum(b) as Usage by idx 
| eval trend=mvmap(trend, if(isnum(trend), round(trend/1024/1024/1024,2), trend))
| eval Usage=round(Usage/1024/1024/1024,2) 
| rename idx AS index 
| sort Usage

This first stats will make the sparkline in sum of bytes. 

The mvmap() command is a trick to convert the sparkline values into GiB figures like you are doing with Usage.

A sparkline is simply a special form of a multivalue field where the first element is the value ##__SPARKLINE__## so this just iterates through the values, ignoring the first and rounds each of the values, so the sparkline also shows in GiB.