Splunk Search

How Do I Add LatestEvent Column to a Sparkline Chart?

Path Finder

I have a search that is currently working to give me a spark line for different event types. The search looks like this:

`eventtype=PS-* 
| chart sparkline count by eventtype` 

Now I can take the fields from the chart and pipe that to table and it works fine too. What I want to do is add a "Latest" column for each EventType that displays the date of the most recent event for each event type. From there I'd also like to add a "First" field as well.

I've tried using stats and eval but those both seem to break the sparkline.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

@JordanPeterson can you try the following?

 eventtype=PS-* 
 | chart sparkline count latest(_time) as "Latest Event" by eventtype
 | fieldformat "Latest Event"=strftime('Latest Event',"%Y/%m/%d %H:%M:%S")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

@JordanPeterson can you try the following?

 eventtype=PS-* 
 | chart sparkline count latest(_time) as "Latest Event" by eventtype
 | fieldformat "Latest Event"=strftime('Latest Event',"%Y/%m/%d %H:%M:%S")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

Path Finder

@niketnilay That worked perfectly. Thank you.

0 Karma