Consolidate multiple sparklines into a single sparkline

[splunkbeginner2]

Hello,

I would like to consolidate multiple sparklines from different rows into a single sparkline, that shows the sum. Is this anyhow possible? I never saw that, but maybe you might have an idea how to do that.

I am looking for something that works like | stats sparkline(sum(sparkline)) but shows me a sparkline, and not a simple number.

Thanks for your support!

Regards,

Xantor

[lguinn2 · Accepted solution]

Try this

yoursearchhere
| stats count sparkline by category
| appendpipe [ stats sum(count) as count sparkline(sum(count)) | eval category="TOTAL" ]

[splunkbeginner2]

Works great, Thank you!