Splunk Search

How to add trend to event counts?

ReachDataScient
Explorer

I have the below search which shows 3 columns....the field1, index list and count of events. How can I add a trend line or a spark line to show if the event count is increasing or decreasing.

| tstats count by index 
| join index type=inner 
| inputlookup LookUp1 
| eval index=lower(index) 
| table field1,index,count 
| sort field1 asc] 
| stats list(index) as index, sum(count) as count by field1
Tags (2)
0 Karma

philipmattocks
Path Finder

For a sparkline try:

| tstats count by index 
| join index type=inner 
[| inputlookup LookUp1 
| eval index=lower(index) 
| table field1,index,count 
| sort field1 asc] 
| stats list(index) as index, sum(count) as count, sparkline(sum(count)) as trend by field1

Let me know if that helps.

Philip

0 Karma

ReachDataScient
Explorer

I tried this before but for the sparkline it shows a flat line with 0 value all across.

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...