Dashboards & Visualizations

Using Sparkline to show successful logins

cburr2012
Path Finder

Hello all,

I am wanting to build a panel in my Dashboard that allows me to see a small sample of the login trends of users.

I think a Sparkline would be a good method to use, based on its compact size and trend-viewing capability.

I've been tinkering around with Sparkline but can't quite get what I'm looking for. I liked the example Splunk Documentation gave of having the magnitudes of the Earthquakes, I feel like my solution should be easier than that. Alas, I am stuck.

My query asks: search this_index this_sourcetype logon_message etc.etc. | stats count by Account_Name | sort count

This shows me my account_names with the highest number of successful logins. Now I'd like to see that in a Sparkline over a short period of time.

Thoughts? Thanks!

Tags (1)
0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

If you do '... | chart sparkline count by Account_Name' is it not giving you what you want?

You can use time modifiers like 'earliest' and 'latest' to specify a time period for your saved search.

http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/SearchTimeModifiers

View solution in original post

sdaniels
Splunk Employee
Splunk Employee

If you do '... | chart sparkline count by Account_Name' is it not giving you what you want?

You can use time modifiers like 'earliest' and 'latest' to specify a time period for your saved search.

http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/SearchTimeModifiers

cburr2012
Path Finder

http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/SearchTimeModifiers provided the proper documentation I needed. Thanks sdaniels.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...