Splunk Search

How do I use a sparkline within tstats to visualize data feed over the last 24 hours?

DEAD_BEEF
Builder

I want to use a tstats command to get a count of various indexes over the last 24 hours. I also want to include the latest event time of each index (so I know logs are still coming in) and add to a sparkline to see the trend.

I'm having trouble as the sparkline is grouping together into one rather than by index. I referenced this post, but am stuck.

| tstats count where (index="email" OR index="b" OR index="ids" OR index="web") BY index _time span=10m
| stats sparkline(sum(count), 10m) AS Volume

alt text

Basically, I'm trying to make a tstats version of this:
alt text

index="a" OR index="b" OR index="c" OR index="d" OR index="e" OR index="f" OR index="g"
| stats sparkline count latest(_time) AS Latest BY index
| convert ctime(Latest)
0 Karma
1 Solution

DEAD_BEEF
Builder

I was finally able to figure it out. Here is the final query

| tstats count where (index="a" OR index="b" OR index="c" OR index="d" OR index="e" OR index="f" OR index="g") BY index _time span=10m 
| stats sparkline(sum(count), 10m) AS Volume latest(_time) AS Latest BY index 
| convert ctime(Latest)

View solution in original post

0 Karma

DEAD_BEEF
Builder

I was finally able to figure it out. Here is the final query

| tstats count where (index="a" OR index="b" OR index="c" OR index="d" OR index="e" OR index="f" OR index="g") BY index _time span=10m 
| stats sparkline(sum(count), 10m) AS Volume latest(_time) AS Latest BY index 
| convert ctime(Latest)
0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...