Splunk Search
Highlighted

Is sparkline adding any new information to my search results?

Communicator

Is sparkline adding any new information to the results of this search, or is it just presenting the same information in a different format?

Here is the search:

| tstats `summariesonly` count from datamodel=Authentication by _time,Authentication.dest span=1h | `drop_dm_object_name("Authentication")` | stats sparkline(sum(count),1h) as sparkline,sum(count) as count by dest | sort - count

So is the sparkline command actually presenting new data from the tstats command?

Tags (3)
0 Karma
Highlighted

Re: Is sparkline adding any new information to my search results?

Champion

Sparkling command just creates a sparkling (chart/graph).

Sparklines are inline charts that appear within table cells in search results, and are designed to display time-based trends associated with the primary key of each row.

If you are working with stats and chart searches, you can increase their usefulness and overall information density by adding sparklines to their result tables.
A sample sparkling is -
alt text

So is the sparkline command actually presenting new data from the tstats command?
actually, it presents the data from stats command.

Highlighted

Re: Is sparkline adding any new information to my search results?

Communicator

Right so what I'm asking is, is this: | stats sparkline(sum(count),1h) as sparkline,sum(count) as count by dest portion of the search just presenting the already-searched-for data in a easier to understand format, or is it actually getting new data? Like, is it getting new data from the indexes that this: | tstats summariesonly count from datamodel=Authentication by _time,Authentication.dest span=1h portion of the search isn't getting?

0 Karma
Highlighted

Re: Is sparkline adding any new information to my search results?

Champion

About, is | stats sparkline(sum(count),1h) as sparkline,sum(count) as count by dest portion of the search just presenting the already-searched-for data in a easier to understand format,

Yes, exactly. It just does a counting and presenting it as sparkline chart.

The tstats get the data and stats+sparkline does counting and charting.

0 Karma