How do you "fillnull" a sparkline field?

[neiljpeterson]

I have a chart with various counts of errors and corresponding Sparklines.

In this instance the null values are just as important as non-zero values, so I used fillnull to fill the Null count fields with zero.

Unfortunately the sparkline fields are blank which breaks the visual continuity of the chart.

How do I fill a null sparkline field with a flat sparkline?

---

This is my final search. It replaces the empty fields with a flat sparkline, then renames and reorders the columns.

sourcetype=*application* severity=ERROR           
| chart count sparkline over app by host | rename "sparkline: server1" AS server1, "sparkline: server2" AS server2 
| eval server1= mvjoin(server1, "%%%") | eventstats max(server1) as temp | eval temp = replace(temp, "\d+", "0") | eval server1= coalesce(server1, temp) | makemv delim="%%%" server1| fields - temp 
| eval server2= mvjoin(server2, "%%%") | eventstats max(server2) as temp | eval temp = replace(temp, "\d+", "0") | eval server2= coalesce(server2, temp) | makemv delim="%%%" server2| fields - temp 
| rename app as Application, server1 as "Errors per half hour on server1", server2 as "Errors per half hour on server2", "count: server2" as "Total Errors on server2", "count: server1" as "Total Errors on server1" 
| table Application, "Total Errors on server2" "Errors per half hour on server2" "Total Errors on server1" "Errors per half hour on server1"

[martin_mueller · Accepted solution]

If your sparkline field is called sparkline, you can append this to fill an empty field with a zeroed out sparkline (requires at least one sparkline to exist:

... | eval sparkline = mvjoin(sparkline, "%%%") | eventstats max(sparkline) as temp | eval temp = replace(temp, "\d+", "0") | eval sparkline = coalesce(sparkline, temp) | makemv delim="%%%" sparkline | fields - temp

It's probably best to move that into a macro with the sparkline fieldname as an argument for reusability.

[neiljpeterson]

This worked!!! I will post my working search as an edit.

[martin_mueller]

As a first step towards debugging your now-posted search, don't name your fields into something fancy (and including spaces) until the very end. That likely confuses the eval command.

[martin_mueller]

A little background on how/why this works: A sparkline field is a multivalue field like this:

##__SPARKLINE__##
0
2
1
2
...

The first value is a magic number, and the values after that are the actual sparkline. My pipeline converts that into a string, takes one of the sparklines to get the correct number of data points, replaces all points with zeroes, and copies that over to any sparkline field that was empty. That gets converted back into multivalue fields to be displayed as if nothing ever happened.

[martin_mueller]

Here's a full work-anywhere sample search:

index=_internal | stats count sparkline(avg(bytes)) as sparkline by sourcetype | append [stats count | eval sourcetype="splunk_fake"] | sort + sourcetype
| eval sparkline = mvjoin(sparkline, "%%%") | eventstats max(sparkline) as temp | eval temp = replace(temp, "\d+", "0") | eval sparkline = coalesce(sparkline, temp) | makemv delim="%%%" sparkline | fields - temp

The first part builds your problem - a category, a count, and a sparkline where one sparkline isn't there. The second line is my sparkline-fillnull-sequence.

[neiljpeterson]

Woah! Awesome! I can't say I understand all of this, but I get the gist.

When I append this at the end of my search it replaces the actual sparkline fields with the text of the field name. I am clearly doing something wrong. I will post my search in a top level comment.