- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to normalize and display data using sparklines?
rm4149
New Member
07-11-2016
01:26 PM
So I'm planning to normalize latency data for a network.
Search:
index=_* OR index=* sourcetype="defaut log"| rename Parent_Host as A , Child_Host as B |eventstats min(In) as minIn max(In) as maxIn by A B|eval val = (In-minIn)/(maxIn-minIn) |stats sparkline(avg(val)) as In by A B
Now I have normalized the data between 0-1 using the eventstats and eval, but can't figure out how to display that normalized data in the sparkline as stats sparkline(val) as In by A B
throws an error and doing stats sparkline(avg(val)) as In by A B
is not same as printing the sparkline of the values.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
diogofgm

SplunkTrust
07-15-2016
11:15 AM
You don't need the () for sparkline. (docs)
Try like this:
index=_* OR index=* sourcetype="defaut log"| rename Parent_Host as A , Child_Host as B |eventstats min(In) as minIn max(In) as maxIn by A B|eval val = (In-minIn)/(maxIn-minIn) | stats sparkline avg(val) as In by A B
------------
Hope I was able to help you. If so, some karma would be appreciated.
Hope I was able to help you. If so, some karma would be appreciated.
