I understand as per docs single value timechart command is required to put sparkline and trendline. However If I am doing the availability % of my service for example "last 24 hours" and it failed once then my sparkline shows one fall but number always shows as 100% because timechart picks the stats over latest bucket while rendering the number.
Currently in Splunk its like:
But ideally I would like to show it as
my search:
index=network sourcetype=nt:logs | stats count(eval('Summary.Error.Code'!="")) as failed_count count as total_count by Test,_time
| eval availability = 100 - ((failed_count/total_count)*100)
| table Test _time availability
| timechart avg(availability) by Test
Any help is appreciated.
