Splunk Search

How to edit my search to prevent my sparkline from displaying as a flat line with zeros for values?

briang67
Communicator

Hello,

I have the following search:

sourcetype=some_data | stats values(msg_type) first(_time) as start by id_field project_field interface_field | evals and lookups etc...

I would like to add a sparkline to count the individual occurrences of the project_field, however, the below results in a sparkline with a flat line with zeros for values:

sourcetype=some_data | stats values(msg_type) first(_time) as start by id_field project_field interface_field | evals and lookups etc... | stats sparkline count by project_field

When I try to add a sparkline to the beginning of the search, I'm seeing an error because the project_field is one of the grouped by fields.

Any ideas?

thanks!

Tags (3)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

A sparkline is inherently timestamp-based, yet the data you send into the sparkline has no _time field.
Think about what value you want as timestamp for the sparkline... might be the start field, might be something else... and put that into a field called _time.

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...