Splunk Search

How to edit my search to prevent my sparkline from displaying as a flat line with zeros for values?

briang67
Communicator

Hello,

I have the following search:

sourcetype=some_data | stats values(msg_type) first(_time) as start by id_field project_field interface_field | evals and lookups etc...

I would like to add a sparkline to count the individual occurrences of the project_field, however, the below results in a sparkline with a flat line with zeros for values:

sourcetype=some_data | stats values(msg_type) first(_time) as start by id_field project_field interface_field | evals and lookups etc... | stats sparkline count by project_field

When I try to add a sparkline to the beginning of the search, I'm seeing an error because the project_field is one of the grouped by fields.

Any ideas?

thanks!

Tags (3)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

A sparkline is inherently timestamp-based, yet the data you send into the sparkline has no _time field.
Think about what value you want as timestamp for the sparkline... might be the start field, might be something else... and put that into a field called _time.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...