Splunk Search

How to normalize and display data using sparklines?

rm4149
New Member

So I'm planning to normalize latency data for a network.

Search:

index=_* OR index=* sourcetype="defaut log"| rename Parent_Host as A , Child_Host as B |eventstats min(In) as minIn  max(In) as maxIn by A B|eval val = (In-minIn)/(maxIn-minIn) |stats sparkline(avg(val)) as In by A B

Now I have normalized the data between 0-1 using the eventstats and eval, but can't figure out how to display that normalized data in the sparkline as stats sparkline(val) as In by A B throws an error and doing stats sparkline(avg(val)) as In by A B is not same as printing the sparkline of the values.

0 Karma

diogofgm
SplunkTrust
SplunkTrust

You don't need the () for sparkline. (docs)
Try like this:

 index=_* OR index=* sourcetype="defaut log"| rename Parent_Host as A , Child_Host as B |eventstats min(In) as minIn  max(In) as maxIn by A B|eval val = (In-minIn)/(maxIn-minIn) | stats sparkline avg(val) as In by A B
------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...