Splunk Search

Appending Sparkline through a JOIN

Drainy
Champion

Good morning!

I'm about to dive into the JS on this to discover how its rendered but in the meantime I thought I'd throw it out here to see if anyone else has come across this..

Imagine a pretty basic search, all I'm doing is pulling back blocked events, no transactions or any funny business.. then I have a brainwave and decide to append a sparkline of blocked events for the same queue. This way I get a timestamp of the most recent block event with a mini timeline of previous blockages...

However, the sparkline is generated in a subsearch (within a join command) and when its passed back it isn't being rendered as a sparkline but instead as the markup for it.

Screenshot below, if anyone has come across this I'd be interested to know, otherwise I guess its just a bug/limitation of sparkline at the moment.

alt text

EDIT: Its worth pointing out that this does work if you reverse it and generate the sparkline first and then append the _time, but I'm interested in the problem now 🙂

0 Karma

dmr195
Communicator

I saw a different situation where a sparkline was being displayed as its text markup rather than as a graphic. In my case it turned out that the sparkline field had ceased to be a multi-valued field. You can make it multi-valued again by appending this to the end of your search (or at least after the join):

| makemv delim="," setsv=true sparkline

As I said, the situation where I saw the problem was completely different to yours, so maybe this won't solve your case, but it worked for me.

mschellhouse
Path Finder

We just upgraded to 7.x. It appears that they resolved the rendering issue as I no longer need to use the |makev * solution.

0 Karma

the0duke0
Path Finder

For us it seems 7.1 has broken the |makemv solution, and removing it doesn't help. I cannot get the sparkline to render if it is in the second part of the join. I was able to work around it by switching the order and having the sparkline before the join.

0 Karma

andymcdowall
Engager

I had the same issue in 7.1.2, removing setsv=true fixed it for me

ktvrznik
Loves-to-Learn Lots

I can confirm that if you remove setsv=true it will fix this issue

0 Karma

swaro_ck
Path Finder

Same problem here with Splunk 7.1.1

0 Karma

troybebee
Engager

Works great. Thanks!

0 Karma

jrodriguezap
Contributor

Very good.
I ran to my well.
Thank you very much!

0 Karma

abchernin
Engager

Situation same as on OP's screenshot -- after join of savedsearch with sparklines, got a column of raw data. Solution worked.

0 Karma

hazekamp
Builder

This did work to correct the sparkline rendering for my search that involved "| join"

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...