Splunk Search

Sparkline and a Timechart Table

jofermin
Explorer

I'm attempting to add a Sparkline to my transposed, timechart statistics table. I read that sparkline only works for stats and charts, but is there any workaround?

Here's my search:

`index=myindex
| timechart span=3month dc(user) by Customer
| transpose
| rename column as Customer, "row 1" as ThreeMonthsBefore, "row 2" as LatestThreeMonths
| regex Customer!=("^_")
| eventstats sum(foo) as NetGain, sum(bar) as Percent

| eval NetGain=LatestThreeMonths-ThreeMonthsBefore
| eval Percent=((NetGain)/ThreeMonthsBefore)*100

| table Customer,ThreeMonthsBefore,LatestThreeMonths,NetGain, Percent
| sort +Customer`

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

It can be done. It's annoying that I had to pass the data twice, though. Here's a run-anywhere example.

index = _internal   earliest=-2h@h latest=@h 
 | chart sparkline count as killme by sourcetype  
 | table sourcetype sparkline
 | join type=left sourcetype
     [search earliest=-2h@h latest=@h index = _internal 
     | bin _time span=1h
     | stats count as usercount  by sourcetype _time
     | stats max(_time) as _time, earliest(usercount) as PriorHour, latest(usercount) as  LatestHour by sourcetype
     | eval NetGain = LatestHour - PriorHour 
     | eval Percent=100*NetGain/PriorHour 
     | table _time, sourcetype, PriorHour, LatestHour, NetGain, Percent ]
 | table sourcetype  PriorHour, LatestHour, NetGain, Percent, sparkline

Below are some older notes...


Here's a recode, not necessarily any better, since it gets you the same place...

index=myindex 
| bin _time span=3mon
| stats dc(user) as usercount  by Customer _time
| stats max(_time) as Time, earliest(usercount ) as ThreeMonthsBefore, latest(usercount) as  LatestThreeMonths by Customer 
| eval NetGain=LatestThreeMonths-ThreeMonthsBefore 
| eval Percent=100*NetGain/ThreeMonthsBefore 
| table _time Customer,ThreeMonthsBefore,LatestThreeMonths, NetGain, Percent 
| sort 0 Customer

Your data doesn't really call for sparklines, since you've chunked it up so high. Hmmm. You could try something like this...

index=myindex 
| bin _time span=3mon
| stats dc(user) as usercount  by Customer _time
| stats max(_time) as Time, earliest(usercount ) as ThreeMonthsBefore, latest(usercount) as  LatestThreeMonths by Customer 
| eval NetGain=LatestThreeMonths-ThreeMonthsBefore 
| eval Percent=100*NetGain/ThreeMonthsBefore 
| table _time Customer,ThreeMonthsBefore,LatestThreeMonths, NetGain, Percent 
| sort 0 Customer
| join Customer 
    [ index=myindex 
    | bin _time span=1mon
    | chart sparkline dc(user) as killme by Customer 
    | table Customer sparkline]
0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...