Splunk Search

Why is the mvcombine breaking sparkline?

subtrakt
Contributor

Hi everyone,

I have a requirement to use mvcombine after stats.

When I use mvcombine the sparkline stops working and presents the sparkling number values instead of the line. Has anyone seen this before?

Also If I put mvcombine before stats it kills the sparkling. I think it has something to do with the lookup prior that uses the url field

| stats values(TEST1) as TEST1 sparkline by url
| mvexpand  TEST1 | eval TEST1=TEST1.”$” | mvcombine TEST1
Tags (3)
0 Karma

niketn
Legend

@subtrakt can you run the following query instead?

 | eval TEST1=TEST1."$"
 | stats values(TEST1) as TEST1 sparkline by url
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...