I'm trying to create a sparkline following the magnitude example from https://docs.splunk.com/Documentation/Splunk/7.3.0/Search/Addsparklinestosearchresults
My search is:
index="stats" | stats sparkline(avg("Search Ops")), avg("Search Ops")
My data is from a csv file which looks like this
Date, Time, Search Ops, Modify Ops
2019/07/22,13:41:50.004,8000,4000
When I run the above search the sparkline returns null, despite there being 500+ events returned, and a returned valid value for avg("Search Ops").
When I instead do this search:
index="medium-dsstats-zeros" | stats sparkline avg("Search Ops")
I do get a sparkline, buts values are the numbers of events/lines in the csv, not the values of the "Search Ops" field. How can I get a sparkline of Search Ops values?
↧