Create a report from a sparkline chart

In this example, you create a report that shows the trends in the number of purchases made over time. This example uses sparkline charts. Sparklines are inline charts that appear in the search results table and are designed to display time-based trends associated with the primary key of each row.

For searches that use the stats and chart commands, you can add sparkline charts to the results table.

CAUTION: This example uses the productName field from the Enabling field lookups section of this tutorial.
If you do not configure the field lookups, the searches in this section will not produce the correct results.
  1. Start a new search.
  2. Set the time range to All time.
  3. Run the following search. 
    sourcetype=access_* status=200 action=purchase| chart sparkline(count) AS "Purchases Trend" count AS Total BY categoryId | rename categoryId AS Category

    This search uses the chart command to count the number of purchases by using action="purchase". The search specifies the purchases made for each product by using categoryId. The difference is that the count of purchases is now an argument of the sparkline() function.

    Note: When you rename a column using the AS keyword, names that are more than one word need to be in quotation marks. In this search quotation marks are around the name Purchases Trend but not around the name Category.

    This screen image shows the results of the search.

  4. Click Save As and select Report.
  5. In the Save Report As dialog box, for Title type Purchasing trends.
  6. For Description, type Count of purchases with trends.
  7. Click Save.
  8. In the confirmation dialog box, click View. Your report should look like this. The screen image shows the saved report.

Next step

This completes Part 6 of the Search Tutorial.

Up to now, you have saved searches as Reports. Continue to Part 7: Creating dashboards, where you learn how to save searches and reports as dashboard panels.