Book Image

Implementing Splunk (Update)

Book Image

Implementing Splunk (Update)

Overview of this book

Table of Contents (20 chapters)
Implementing Splunk Second Edition
Credits
About the Authors
About the Reviewers
www.PacktPub.com
Preface
Index

Sparklines


Growing in popularity as a data visualization option, Sparklines are inline charts that represent the general shape of a variation (typically over time) in some measurement (such as miles per gallon or home value), in a simple and highly condensed way. Splunk provides the ability for you to add Sparklines to stats and chart searches, improving their usefulness and overall information density.

A simple Splunk search example like

sourcetype=csv "0001" "USD" | chart AVG(Jan) by PERIOD

creates the following results table:

As you can see, the preceding example of a search, generates a table that shows average amounts by the field PERIOD—just two columns.

If you add the keyword sparkline to the search pipeline, you can have Splunk include Sparklines with the results.

Note

You always use the Sparklines feature in conjunction with chart and stats because it is a function (of those two search commands) and not a command by itself.

sourcetype=csv "0001" "USD" | chart sparkline AVG(Jan) by PERIOD...