Reporting

Feeding Sparkline with Data Model

splunkbeginner2
Path Finder

Hello,

for a dashboard I will need to display a sparkline with entries blocked / Accessed by an ACL from the Cisco IOS app. Because of the availability of data models I would like to use them to access the data. Unfortunately I am currently not able to create a sparkline that displays what i wanted.

I am able to get 9 charts that can display when each of the values was reached
(e.g.
2 hits at: 10:10, 10:30,10:40
3 hits at 10:20,
4 hits at: 10:50, 11:00
)

[All numbers displayed in a graph]

How could I get this data into a single graph?

| pivot Cisco_IOS_Event Blocked_Access_List_Event Blocked_Access_List_Event AS "val" SPLITROW _time AS _time PERIOD auto SORT 0 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1  |                        eval count=val | eval name="name" | eval Time=_time|chart sparkline by val

Thanks for your help!

Regards!

0 Karma
1 Solution

splunkbeginner2
Path Finder

I fixed it. The solution was the following:

  1. I debugged the source of the Cisco IOS App. They use saved searches.
  2. Open Search in Splunk -> Settings->Searches --> Cisco uses the old notation.
  3. Using the old scheme of notation:

search index="cisco-firewall" action="blocked" | chart sparklines

Simple, but works. However I have to admit that I would have preferred a solution with the data model.

Best Regards!

View solution in original post

0 Karma

splunkbeginner2
Path Finder

I fixed it. The solution was the following:

  1. I debugged the source of the Cisco IOS App. They use saved searches.
  2. Open Search in Splunk -> Settings->Searches --> Cisco uses the old notation.
  3. Using the old scheme of notation:

search index="cisco-firewall" action="blocked" | chart sparklines

Simple, but works. However I have to admit that I would have preferred a solution with the data model.

Best Regards!

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...