Splunk Search

Consolidate multiple sparklines into a single sparkline

splunkbeginner2
Path Finder

Hello,

I would like to consolidate multiple sparklines from different rows into a single sparkline, that shows the sum. Is this anyhow possible? I never saw that, but maybe you might have an idea how to do that.

I am looking for something that works like | stats sparkline(sum(sparkline)) but shows me a sparkline, and not a simple number.

Thanks for your support!

Regards,

Xantor

1 Solution

lguinn2
Legend

Try this

yoursearchhere
| stats count sparkline by category
| appendpipe [ stats sum(count) as count sparkline(sum(count)) | eval category="TOTAL" ]

View solution in original post

lguinn2
Legend

Try this

yoursearchhere
| stats count sparkline by category
| appendpipe [ stats sum(count) as count sparkline(sum(count)) | eval category="TOTAL" ]

splunkbeginner2
Path Finder

Works great, Thank you!

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...