Splunk Search

How do I do sparklines based on lookup table data

MonkeyK
Builder

Trying to create a sparkline from data in a lookup table

monitor_user_traffic.csv has fields
-user
-traffic_dest_ip
-app
-bytes_out
-time

when I run
| inputlookup monitor_user_traffic.csv
| eval _time=time
| stats sum(bytes_out) sparkline(sum(bytes_out),1d) as data_trend by user traffic_dest_ip app

I get a value for "sum(bytes_out)" but nothing under "sparkline(sum(bytes_out),1d) as data_trend"

Is there some sort of magical way that I need to alert my data for Splunk to be able to create a sparkline?

Tags (2)
0 Karma

to4kawa
Ultra Champion
| gentimes start=1/1/2020 increment=12h end=31/1/2020 
| rename starttime as time 
| eval user=mvindex(split("A#B#C","#"),(random() % 3)) 
| eval traffic_dest_ip=mvindex(split("X.X.X.X#Y.Y.Y.Y","#"),(random() % 2))
| eval app="win"
| eval bytes_out=random() % 200 + 10 
`comment("this is sample, | inputlookup your_csv")`
| eval _time=time 
| stats sum(bytes_out) sparkline(sum(bytes_out),1d) as data_trend by user traffic_dest_ip app
0 Karma

niketnilay
Legend

@MonkeyK is the time field in lookup epoch time or string time. Do convert to epoch time using strptime() function.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

MonkeyK
Builder

@niketnilay time is in epoch time.

I have since figured out that if I sort the _time field with a key of "_time" rather than "time" it works.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...