Splunk Search

How do I rehydrate a sparkline from a lookup?

MonkeyK
Builder

Sometimes I run a really complex query and accumulate results in a lookup table.  I recently tried doing this and including a sparkline, which gave me a field that looked like

trend
##__SPARKLINE__##,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,63,55,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0

 

If I just run "|inputlookup" to visualize that data, I just get the raw data back.  Is there a command that turns the stored sparkline data back into a sparkline?

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| eval trend=split(trend,",")

View solution in original post

MonkeyK
Builder

works great!  thanks!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| eval trend=split(trend,",")
Get Updates on the Splunk Community!

Simplifying the Analyst Experience with Finding-based Detections

    Splunk invites you to an engaging Tech Talk focused on streamlining security operations with ...

[Puzzles] Solve, Learn, Repeat: Word Search

This challenge was first posted on Slack #puzzles channelThis puzzle is based on a letter grid containing ...

[Puzzles] Solve, Learn, Repeat: Advent of Code - Day 4

Advent of CodeIn order to participate in these challenges, you will need to register with the Advent of Code ...