Splunk Search

Why is the mvcombine breaking sparkline?

subtrakt
Contributor

Hi everyone,

I have a requirement to use mvcombine after stats.

When I use mvcombine the sparkline stops working and presents the sparkling number values instead of the line. Has anyone seen this before?

Also If I put mvcombine before stats it kills the sparkling. I think it has something to do with the lookup prior that uses the url field

| stats values(TEST1) as TEST1 sparkline by url
| mvexpand  TEST1 | eval TEST1=TEST1.”$” | mvcombine TEST1
Tags (3)
0 Karma

niketn
Legend

@subtrakt can you run the following query instead?

 | eval TEST1=TEST1."$"
 | stats values(TEST1) as TEST1 sparkline by url
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...