Splunk Search

Is sparkline adding any new information to my search results?

Justin1224
Communicator

Is sparkline adding any new information to the results of this search, or is it just presenting the same information in a different format?

Here is the search:

| tstats `summariesonly` count from datamodel=Authentication by _time,Authentication.dest span=1h | `drop_dm_object_name("Authentication")` | stats sparkline(sum(count),1h) as sparkline,sum(count) as count by dest | sort - count

So is the sparkline command actually presenting new data from the tstats command?

Tags (3)
0 Karma

inventsekar
Ultra Champion

Sparkling command just creates a sparkling (chart/graph).

Sparklines are inline charts that appear within table cells in search results, and are designed to display time-based trends associated with the primary key of each row.

If you are working with stats and chart searches, you can increase their usefulness and overall information density by adding sparklines to their result tables.
A sample sparkling is -
alt text

So is the sparkline command actually presenting new data from the tstats command?
actually, it presents the data from stats command.

Justin1224
Communicator

Right so what I'm asking is, is this: | stats sparkline(sum(count),1h) as sparkline,sum(count) as count by dest portion of the search just presenting the already-searched-for data in a easier to understand format, or is it actually getting new data? Like, is it getting new data from the indexes that this: | tstats summariesonly count from datamodel=Authentication by _time,Authentication.dest span=1h portion of the search isn't getting?

0 Karma

inventsekar
Ultra Champion

About, is | stats sparkline(sum(count),1h) as sparkline,sum(count) as count by dest portion of the search just presenting the already-searched-for data in a easier to understand format,

Yes, exactly. It just does a counting and presenting it as sparkline chart.

The tstats get the data and stats+sparkline does counting and charting.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...