It can be done. It's annoying that I had to pass the data twice, though. Here's a run-anywhere example.
index = _internal earliest=-2h@h latest=@h
| chart sparkline count as killme by sourcetype
| table sourcetype sparkline
| join type=left sourcetype
[search earliest=-2h@h latest=@h index = _internal
| bin _time span=1h
| stats count as usercount by sourcetype _time
| stats max(_time) as _time, earliest(usercount) as PriorHour, latest(usercount) as LatestHour by sourcetype
| eval NetGain = LatestHour - PriorHour
| eval Percent=100*NetGain/PriorHour
| table _time, sourcetype, PriorHour, LatestHour, NetGain, Percent ]
| table sourcetype PriorHour, LatestHour, NetGain, Percent, sparkline
Below are some older notes...
Here's a recode, not necessarily any better, since it gets you the same place...
index=myindex
| bin _time span=3mon
| stats dc(user) as usercount by Customer _time
| stats max(_time) as Time, earliest(usercount ) as ThreeMonthsBefore, latest(usercount) as LatestThreeMonths by Customer
| eval NetGain=LatestThreeMonths-ThreeMonthsBefore
| eval Percent=100*NetGain/ThreeMonthsBefore
| table _time Customer,ThreeMonthsBefore,LatestThreeMonths, NetGain, Percent
| sort 0 Customer
Your data doesn't really call for sparklines, since you've chunked it up so high. Hmmm. You could try something like this...
index=myindex
| bin _time span=3mon
| stats dc(user) as usercount by Customer _time
| stats max(_time) as Time, earliest(usercount ) as ThreeMonthsBefore, latest(usercount) as LatestThreeMonths by Customer
| eval NetGain=LatestThreeMonths-ThreeMonthsBefore
| eval Percent=100*NetGain/ThreeMonthsBefore
| table _time Customer,ThreeMonthsBefore,LatestThreeMonths, NetGain, Percent
| sort 0 Customer
| join Customer
[ index=myindex
| bin _time span=1mon
| chart sparkline dc(user) as killme by Customer
| table Customer sparkline]
... View more