Hi
I have a 15 minute real time search creating a sparkling and it looks great when it works.
However often it looks like this, flat and i am not sure why.
I use this for the SPLUNK_HOME page so many user can log in. So i have created a savedsearch that is Real-Time
| savedsearch HOME_LIVE_EVENTS_SPARKLINE (This is a 15 minute real time search)
This is a
index=mlc_live | table host | chart sparkline count by host | fields - count (This is a 15 minute real time search)
Any ideas how to get it to work 100% of the time.
Rob
@robertlynch2020
Just added _time
.
Can you please try this?
index=mlc_live | table host _time | chart sparkline count by host | fields - count
_time
is required for sparkline.
Happy Splunking
@robertlynch2020
Just added _time
.
Can you please try this?
index=mlc_live | table host _time | chart sparkline count by host | fields - count
_time
is required for sparkline.
Happy Splunking
Perfect thanks 🙂
Great @robertlynch2020
Can you please upvote and accept this answer to close question?
Sure - sorry and thanks very much