Splunk Search

How do I do sparklines based on lookup table data

MonkeyK
Builder

Trying to create a sparkline from data in a lookup table

monitor_user_traffic.csv has fields
-user
-traffic_dest_ip
-app
-bytes_out
-time

when I run
| inputlookup monitor_user_traffic.csv
| eval _time=time
| stats sum(bytes_out) sparkline(sum(bytes_out),1d) as data_trend by user traffic_dest_ip app

I get a value for "sum(bytes_out)" but nothing under "sparkline(sum(bytes_out),1d) as data_trend"

Is there some sort of magical way that I need to alert my data for Splunk to be able to create a sparkline?

Tags (2)
0 Karma

to4kawa
Ultra Champion
| gentimes start=1/1/2020 increment=12h end=31/1/2020 
| rename starttime as time 
| eval user=mvindex(split("A#B#C","#"),(random() % 3)) 
| eval traffic_dest_ip=mvindex(split("X.X.X.X#Y.Y.Y.Y","#"),(random() % 2))
| eval app="win"
| eval bytes_out=random() % 200 + 10 
`comment("this is sample, | inputlookup your_csv")`
| eval _time=time 
| stats sum(bytes_out) sparkline(sum(bytes_out),1d) as data_trend by user traffic_dest_ip app
0 Karma

niketn
Legend

@MonkeyK is the time field in lookup epoch time or string time. Do convert to epoch time using strptime() function.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

MonkeyK
Builder

@niketn time is in epoch time.

I have since figured out that if I sort the _time field with a key of "_time" rather than "time" it works.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...