You can generate sparkline charts with the tstats command only if you specify the _time field in the BY clause and use the stats command to generate the actual sparkline. For example: | tstats count from datamodel=Authentication.Authentication BY _time, Authentication.src span=1h | stats sparkline(sum(count),1h) AS sparkline, sum(count) as count BY Authentication.src Also, I don't know if the limit suggested is accurate. When you run the following command, you get many more data points than 101 which are charted: index=_internal | chart sparkline count by sourcetype ... View more

use appendcols instead of Join ... View more