Splunk Search

Why is Sparkline not working properly?

juliehope14
Engager

Hi all,

I need help with the sparkline in my spl search because it is not displaying values on the statistics table. Also, when I click the cell it shows the value of the Trend which is only this: "Trend = ##SPARKLINE##". I am using Splunk Cloud version 7.2.6.

Please see below for my search:

| pivot dm_datamodel ds_dataset SPLITROW Environment FILTER Environment in ("*") SPLITROW servername FILTER servername in ("*") SPLITROW TicketId FILTER TicketId in ("*") SPLITROW Severity FILTER Severity in ("*") SPLITROW AlertName SPLITROW PubMsg SPLITROW AlertTime SPLITROW utc_AlertTime
| eventstats count(utc_AlertTime) as alert_count by servername
| eventstats sparkline(avg(alert_count)) as Trend by servername

ivanreis
Builder

I checked the splunk documents and it is mention that sparkline command can be used with stat and chart commands. Although eventstats is a variation of stat, I would try to use stats or chart on this line

| stats sparkline(avg(alert_count)) as Trend by servername

Here is the document I found -> https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/CommonStatsFunctions#Support_for_...

0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...