Splunk Search

Tstats with Sparkline limiting values

biers04
Explorer

I am working on statsing firewall data into a sparkline.  However, when I run the search, the sparkline caps out at 1800 results.  This ends up being an issue because some sparklines end up just looking like a flat line, which is not very useful. Is there a way to work around this/a fix to this?

| tstats count from datamodel=firewall where firewall.signature!="(9999)" by firewall.signature, _time, span=1ms
| stats sparkline sum(count) by log.threat_name

Sparkline limit @ 1800Sparkline limit @ 1800

Labels (1)
Tags (2)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!