This works, but there is a problem: the sparkline displays a value of 0 as the first or last value, depending on when the search is run. It assumes that the value is 0 when the search time range includes part of a day that does not have data. For example, if the search includes the last 2 hours of Tuesday, it will assume a 0, because the data from Tuesday was reported at 4 am.
So, how do I get sparkline to ignore these values, or get the search to not include "partial" days? I've tried usenull=f in the chart command, but it doesn't seem to work for sparklines. I realize that making this a scheduled search would probably work if I get the time ranges just right, but I feel like there is a more elegant way to do it, and I don't want it to break if the reporting frequency changes or moves to a different time.