I have the following search, search1
:
...| chart avg(c84150606) as "avg(CONNECTED_RATIO)" sparkline(avg(CONNECTED_RATIO), 15m) as CONNECTED_RATIO by userLabel
this gives me this stats1
in the stats tab, but the sparkline is not showing:
userLabel avg(CONNECTED_RATIO) CONNECTED_RATIO
MSC01HAM 91.138624 <SPARK_LINE_NOT_SHOWING>
MSCKPR 84.608529 <SPARK_LINE_NOT_SHOWING>
with this search search2
...| chart avg(c84150606) sparkline(avg(c84150606), 15m) as CONNECTED_RATIO by userLabel
I can get the sparkline to show in stats2
in the stats tab
userLabel avg(c84150606) CONNECTED_RATIO
MSC01HAM 91.138624 <SPARK_LINE_IS_SHOWING>
MSCKPR 84.608529 <SPARK_LINE_IS_SHOWING>
but I in stats2
I want the 2nd column header avg(c84150606)
to be avg(CONNECTED_RATIO)
.
How can I achieve this?
You can also try using the rename command:
...| chart avg(c84150606) sparkline(avg(c84150606), 15m) as CONNECTED_RATIO by userLabel | rename avg(c84150606) as avg(CONNECTED_RATIO)
http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Rename
You can also try using the rename command:
...| chart avg(c84150606) sparkline(avg(c84150606), 15m) as CONNECTED_RATIO by userLabel | rename avg(c84150606) as avg(CONNECTED_RATIO)
http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Rename
thanks, tried rename every which way but that way 🙂 you should edit your answer so i can accpet it or can i accept it as is?
Hey @HattrickNZ
Sorry I just revisited this post again now. I converted the comment to an answer for acceptability 🙂 cheers and happy Friday!
Patrick