Sparkline and a Timechart Table

[jofermin]

I'm attempting to add a Sparkline to my transposed, timechart statistics table. I read that sparkline only works for stats and charts, but is there any workaround?

Here's my search:

`index=myindex
| timechart span=3month dc(user) by Customer
| transpose
| rename column as Customer, "row 1" as ThreeMonthsBefore, "row 2" as LatestThreeMonths
| regex Customer!=("^_")
| eventstats sum(foo) as NetGain, sum(bar) as Percent

| eval NetGain=LatestThreeMonths-ThreeMonthsBefore
| eval Percent=((NetGain)/ThreeMonthsBefore)*100

| table Customer,ThreeMonthsBefore,LatestThreeMonths,NetGain, Percent
| sort +Customer`

[DalJeanis]

It can be done. It's annoying that I had to pass the data twice, though. Here's a run-anywhere example.

index = _internal   earliest=-2h@h latest=@h 
 | chart sparkline count as killme by sourcetype  
 | table sourcetype sparkline
 | join type=left sourcetype
     [search earliest=-2h@h latest=@h index = _internal 
     | bin _time span=1h
     | stats count as usercount  by sourcetype _time
     | stats max(_time) as _time, earliest(usercount) as PriorHour, latest(usercount) as  LatestHour by sourcetype
     | eval NetGain = LatestHour - PriorHour 
     | eval Percent=100*NetGain/PriorHour 
     | table _time, sourcetype, PriorHour, LatestHour, NetGain, Percent ]
 | table sourcetype  PriorHour, LatestHour, NetGain, Percent, sparkline

Below are some older notes...

---

Here's a recode, not necessarily any better, since it gets you the same place...

index=myindex 
| bin _time span=3mon
| stats dc(user) as usercount  by Customer _time
| stats max(_time) as Time, earliest(usercount ) as ThreeMonthsBefore, latest(usercount) as  LatestThreeMonths by Customer 
| eval NetGain=LatestThreeMonths-ThreeMonthsBefore 
| eval Percent=100*NetGain/ThreeMonthsBefore 
| table _time Customer,ThreeMonthsBefore,LatestThreeMonths, NetGain, Percent 
| sort 0 Customer

Your data doesn't really call for sparklines, since you've chunked it up so high. Hmmm. You could try something like this...

index=myindex 
| bin _time span=3mon
| stats dc(user) as usercount  by Customer _time
| stats max(_time) as Time, earliest(usercount ) as ThreeMonthsBefore, latest(usercount) as  LatestThreeMonths by Customer 
| eval NetGain=LatestThreeMonths-ThreeMonthsBefore 
| eval Percent=100*NetGain/ThreeMonthsBefore 
| table _time Customer,ThreeMonthsBefore,LatestThreeMonths, NetGain, Percent 
| sort 0 Customer
| join Customer 
    [ index=myindex 
    | bin _time span=1mon
    | chart sparkline dc(user) as killme by Customer 
    | table Customer sparkline]