Splunk Search

How Do I Add LatestEvent Column to a Sparkline Chart?

JordanPeterson
Path Finder

I have a search that is currently working to give me a spark line for different event types. The search looks like this:

`eventtype=PS-* 
| chart sparkline count by eventtype` 

Now I can take the fields from the chart and pipe that to table and it works fine too. What I want to do is add a "Latest" column for each EventType that displays the date of the most recent event for each event type. From there I'd also like to add a "First" field as well.

I've tried using stats and eval but those both seem to break the sparkline.

0 Karma
1 Solution

niketn
Legend

@JordanPeterson can you try the following?

 eventtype=PS-* 
 | chart sparkline count latest(_time) as "Latest Event" by eventtype
 | fieldformat "Latest Event"=strftime('Latest Event',"%Y/%m/%d %H:%M:%S")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@JordanPeterson can you try the following?

 eventtype=PS-* 
 | chart sparkline count latest(_time) as "Latest Event" by eventtype
 | fieldformat "Latest Event"=strftime('Latest Event',"%Y/%m/%d %H:%M:%S")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

JordanPeterson
Path Finder

@niketnilay That worked perfectly. Thank you.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...