Splunk Search

Sparkline and a Timechart Table

Explorer

I'm attempting to add a Sparkline to my transposed, timechart statistics table. I read that sparkline only works for stats and charts, but is there any workaround?

Here's my search:

`index=myindex
| timechart span=3month dc(user) by Customer
| transpose
| rename column as Customer, "row 1" as ThreeMonthsBefore, "row 2" as LatestThreeMonths
| regex Customer!=("^_")
| eventstats sum(foo) as NetGain, sum(bar) as Percent

| eval NetGain=LatestThreeMonths-ThreeMonthsBefore
| eval Percent=((NetGain)/ThreeMonthsBefore)*100

| table Customer,ThreeMonthsBefore,LatestThreeMonths,NetGain, Percent
| sort +Customer`

0 Karma

SplunkTrust
SplunkTrust

It can be done. It's annoying that I had to pass the data twice, though. Here's a run-anywhere example.

index = _internal   earliest=-2h@h latest=@h 
 | chart sparkline count as killme by sourcetype  
 | table sourcetype sparkline
 | join type=left sourcetype
     [search earliest=-2h@h latest=@h index = _internal 
     | bin _time span=1h
     | stats count as usercount  by sourcetype _time
     | stats max(_time) as _time, earliest(usercount) as PriorHour, latest(usercount) as  LatestHour by sourcetype
     | eval NetGain = LatestHour - PriorHour 
     | eval Percent=100*NetGain/PriorHour 
     | table _time, sourcetype, PriorHour, LatestHour, NetGain, Percent ]
 | table sourcetype  PriorHour, LatestHour, NetGain, Percent, sparkline

Below are some older notes...


Here's a recode, not necessarily any better, since it gets you the same place...

index=myindex 
| bin _time span=3mon
| stats dc(user) as usercount  by Customer _time
| stats max(_time) as Time, earliest(usercount ) as ThreeMonthsBefore, latest(usercount) as  LatestThreeMonths by Customer 
| eval NetGain=LatestThreeMonths-ThreeMonthsBefore 
| eval Percent=100*NetGain/ThreeMonthsBefore 
| table _time Customer,ThreeMonthsBefore,LatestThreeMonths, NetGain, Percent 
| sort 0 Customer

Your data doesn't really call for sparklines, since you've chunked it up so high. Hmmm. You could try something like this...

index=myindex 
| bin _time span=3mon
| stats dc(user) as usercount  by Customer _time
| stats max(_time) as Time, earliest(usercount ) as ThreeMonthsBefore, latest(usercount) as  LatestThreeMonths by Customer 
| eval NetGain=LatestThreeMonths-ThreeMonthsBefore 
| eval Percent=100*NetGain/ThreeMonthsBefore 
| table _time Customer,ThreeMonthsBefore,LatestThreeMonths, NetGain, Percent 
| sort 0 Customer
| join Customer 
    [ index=myindex 
    | bin _time span=1mon
    | chart sparkline dc(user) as killme by Customer 
    | table Customer sparkline]
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!