I have a search that is currently working to give me a spark line for different event types. The search looks like this:
eventtype=PS-*
| chart sparkline count by eventtype
Now I can take the fields from the chart and pipe that to table and it works fine too. What I want to do is add a "Latest" column for each EventType that displays the date of the most recent event for each event type. From there I'd also like to add a "First" field as well.
I've tried using stats and eval but those both seem to break the sparkline.
↧