untranspose multi-field sparkline

[coo]

| chart sparkline count by a,b

I would like to have sparkline table like...

a      | b   | count | sparkline
thing1 | foo | 123   | _^_
thing2 | bar | 456   | _^_

But sparkline does an implicit transpose like...

a      | count: foo | count: bar | sparkline: foo | sparkline: bar
thing1 | 123        | 0          | _^_            | 
thing2 | 0          | 456        |                | _^_

Is it possible to produce the desired table?

[asimit · Accepted solution]

Hey @coo 

I had the exact same issue previously with chart sparkline count by field1,field2 - it always transposes and gives you columns instead of nice rows.

Here's the clean fix that works perfectly:

index=_internal sourcetype=splunkd*
| rename host as a, sourcetype as b
| stats count as count by _time a b
| fillnull value=0 count
| stats sparkline(count) as sparkline
        sum(count) as count
        by a b
| table a b count sparkline

What it does:

1. stats count by _time a b → gets time-series data per host+sourcetype

2. fillnull value=0 → handles gaps for smooth sparklines

3. stats sparkline(count) ... by a b → one sparkline per host+sourcetype row

4. Perfect table: a | b | count | sparkline

Seen the attached screenshot for better understanding, No more transpose headaches!

Please give 👍 for support 😁 happly splunking .... 😎

[coo]

Thanks for responding. Here is my ultimate solution.

| stats count by _time,a,b
| stats sum(count) as count,sparkline(count) as sparkline by a,b
| sort -count

[richgalloway]

Use the table command to put the fields in the desired order

| chart sparkline count by a,b
| table a b count sparkline

[coo]

Thanks for responding. This was the result.

a      | b   | count | sparkline
thing1 |     |       | 
thing2 |     |       |