Splunk Search

Using Sparklines with mstats

eddieddieddie
Path Finder

How do I draw a Sparkline from data that comes from a metrics index (ie accessed via the mstats command)?

I've tried various combinations of:

| mstats span=5m latest(LogicalDisk.%_Free_Space) as FreePercentSpace WHERE index=metrics_index host=HOSTYMCHOSTFACE instance="*:"
| stats sparkline count by instance

And tried adding "prestats=true" to the end of the mstats command but still nothing happens. I assume there is some sort of intermediate command I need to put between the two lines to make the data palatable for stats (or chart) to process?

Thanks
Eddie

Labels (1)
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...