Splunk Search

How do I add sparkline to the search result for generating a report?

mike7860
Explorer

I need to add a sparkline to the search result so that I can create a visualization of which index is reporting a spike in usage. My serach result is as follows:

earliest=-2d@d latest=-1d@d index=_internal group="per_index_thruput" | eval rmb = round(kb/1024, 2) | eval rgb = round(rmb/1024, 2) | eval mb = kb/1024 | eval gb = round(kb/1024/1024, 2) | stats sum(gb) AS "Total GB" by series | addcoltotals

Tags (1)
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

It's a charting command, you could place it inline with your other stats command. What stat did you want to show in the sparkline?

earliest=-2d@d latest=-1d@d index=_internal group="per_index_thruput" | eval rmb = round(kb/1024, 2) | eval rgb = round(rmb/1024, 2) | eval mb = kb/1024 | eval gb = round(kb/1024/1024, 2) | stats sparkline sum(gb), sum(gb) AS "Total GB" by series | addcoltotals

http://docs.splunk.com/Documentation/Splunk/5.0/Search/Addsparklinestosearchresults

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...