Splunk Search

Why is the mvcombine breaking sparkline?


Hi everyone,

I have a requirement to use mvcombine after stats.

When I use mvcombine the sparkline stops working and presents the sparkling number values instead of the line. Has anyone seen this before?

Also If I put mvcombine before stats it kills the sparkling. I think it has something to do with the lookup prior that uses the url field

| stats values(TEST1) as TEST1 sparkline by url
| mvexpand  TEST1 | eval TEST1=TEST1.”$” | mvcombine TEST1
Tags (3)
0 Karma


@subtrakt can you run the following query instead?

 | eval TEST1=TEST1."$"
 | stats values(TEST1) as TEST1 sparkline by url
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!