Hi
I am on version 7.1.6 and want to move to 7.2.6 but i have noticed that spark-lines don't work in the new version.
Or am i missing something?
This is the SPL
index=mlc_live | table host _time| chart sparkline count by host | fields - count
When i change from fast mode to verbose mode in SPL it works, but you cant save a search that way.
Any help would be great.
Hi. I did a quick test on my Mac with 7.2.6 and I see the bug as well.
I opened a case with Splunk. I will post results here.
I also discovered it is the order of the arguments. For example the following DOES work in 7.2.6
index=_internal | chart count
sparkline by sourcetype | sort -count
I would try using stats/chart command first then table the results.
index=_internal | stats sparkline count by host | table host sparkline count
I tried the following run anywhere example in Windows
machine with 7.2.6
on chrome, edge, IE and Firefox
browsers and it worked fine.
<dashboard>
<label>Sparkline</label>
<row>
<panel>
<table>
<search>
<query>index=_internal
| chart sparkline count by sourcetype
| fields - count</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</dashboard>
Which mode did you test in?
Since this is dashboard it will not need search mode. However, I did test test with Fast Mode as well.
Hi. I did a quick test on my Mac with 7.2.6 and I see the bug as well.
I opened a case with Splunk. I will post results here.
I also discovered it is the order of the arguments. For example the following DOES work in 7.2.6
index=_internal | chart count
sparkline by sourcetype | sort -count
@robertlynch2020 try just removing the table line in your query.
I think your sparkline will work in all modes then.
Hi
From one Splunk Ninja(2017) to another(2018) - thanks very much 🙂
@burwell : removing table command worked !! cheers!