First of all, we need to go to the Sparkline documentation page :
http://omnipotent.net/jquery.sparkline/#s-about
If you play with the generator you can see ye need a "Bullet" sparkline.
To add this sparkline into your tables, we need to cheat a little cause bullet sparklines want datas like this : target,performance,range. So a stats sparkline() will be difficult.
To continue you need a search returning at least a field containing a value between 0 and 100, we will call it "value" in the next example search.
We create the percentage column like this :
search |eval Percentage= "##__SPARKLINE__##,0,"+value+",100"| makemv delim="," Percentage
Here we create a new field Percentage that Splunk will interprate as a Sparkline.
If you run this search in the search view, you will have a sparkline with 3 values because by default its a "line" sparkline.
We need to create a view to add parameters. I use advanced xml. You have to and add the following conguration to your table :
<module name="SimpleResultsTable">
<param name="count">100</param>
<param name="fieldFormats"><param name="Percentage"><list>
<param name="type">sparkline</param>
<param name="options">
<param name="type">bullet</param>
<param name="height">20px</param>
<param name="width">150px</param>
<param name="targetWidth">1px</param>
<param name="targetColor">#007f7f</param>
<param name="performanceColor">#007f7f</param>
</param></list>
</param></param>
</module
And here we go, a nice way to display percentage values !
Hope it will be usefull for some of you 🙂
