Splunk Search

Consolidate multiple sparklines into a single sparkline

Path Finder

Hello,

I would like to consolidate multiple sparklines from different rows into a single sparkline, that shows the sum. Is this anyhow possible? I never saw that, but maybe you might have an idea how to do that.

I am looking for something that works like | stats sparkline(sum(sparkline)) but shows me a sparkline, and not a simple number.

Thanks for your support!

Regards,

Xantor

1 Solution

Legend

Try this

yoursearchhere
| stats count sparkline by category
| appendpipe [ stats sum(count) as count sparkline(sum(count)) | eval category="TOTAL" ]

View solution in original post

Legend

Try this

yoursearchhere
| stats count sparkline by category
| appendpipe [ stats sum(count) as count sparkline(sum(count)) | eval category="TOTAL" ]

View solution in original post

Path Finder

Works great, Thank you!