Is sparkline adding any new information to my search results?

[Justin1224]

Is sparkline adding any new information to the results of this search, or is it just presenting the same information in a different format?

Here is the search:

| tstats `summariesonly` count from datamodel=Authentication by _time,Authentication.dest span=1h | `drop_dm_object_name("Authentication")` | stats sparkline(sum(count),1h) as sparkline,sum(count) as count by dest | sort - count

So is the sparkline command actually presenting new data from the tstats command?

[inventsekar]

Sparkling command just creates a sparkling (chart/graph).

Sparklines are inline charts that appear within table cells in search results, and are designed to display time-based trends associated with the primary key of each row.

If you are working with stats and chart searches, you can increase their usefulness and overall information density by adding sparklines to their result tables.
A sample sparkling is -

So is the sparkline command actually presenting new data from the tstats command?
actually, it presents the data from stats command.

[Justin1224]

Right so what I'm asking is, is this: | stats sparkline(sum(count),1h) as sparkline,sum(count) as count by dest portion of the search just presenting the already-searched-for data in a easier to understand format, or is it actually getting new data? Like, is it getting new data from the indexes that this: | tstats summariesonly count from datamodel=Authentication by _time,Authentication.dest span=1h portion of the search isn't getting?

[inventsekar]

About, is | stats sparkline(sum(count),1h) as sparkline,sum(count) as count by dest portion of the search just presenting the already-searched-for data in a easier to understand format,

Yes, exactly. It just does a counting and presenting it as sparkline chart.

The tstats get the data and stats+sparkline does counting and charting.