topic Re: How can I change the sort order of data in a Trellis chart? in Dashboards & Visualizations

How can I change the sort order of data in a Trellis chart?

ejharts2015 — Thu, 17 Aug 2017 20:52:05 GMT

I've been playing around with the new trellis dashboard layout. In the search we have different levels of errors, like Severity Level 1, 2, 3, etc.

Is there any way to order the way the cards show up? So we can show Level 1, then 2 then three from left to right?

Seems like they default to alphabetical no matter how you sort them in the search.

Re: How can I change the sort order of data in a Trellis chart?

kmorris_splunk — Thu, 17 Aug 2017 21:19:14 GMT

This should be determined by the sort order for your data. However, there seems to be an issue with it. If you look at the bottom of the page in the docs, you see some communication regarding sort not working for the order of the trellis panels, only for the data in the table at the bottom. The last comment was from June 28th regarding the issue.

The sort command issue is SPL-142769
Frobinson splunk, Splunker
June 28, 2017

From the docs:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Viz/VisualizationTrellis
To change the order in which segments appear, adjust the search to sort or change search result order.

Re: How can I change the sort order of data in a Trellis chart?

quahfamili — Wed, 13 Jun 2018 05:49:32 GMT

Has anyone solved this yet? I have the same problem trying to change the sort order. Currently I just something like this:

base search | stats count by something| table field1 field2 field3 field4

to force the sorting. It is not ideal cos if the "something" fields has a new variable, It will not be displayed.

Re: How can I change the sort order of data in a Trellis chart?

harishalipaka — Wed, 13 Jun 2018 06:43:45 GMT

Hi @quahfamili
can you try like this

|eval sortingtable=if(Level="level 1",1,if(Level="level 2",2,case(Level="level 3",3))) | sort sortingtable

Re: How can I change the sort order of data in a Trellis chart?

niketn — Wed, 13 Jun 2018 07:42:24 GMT

@quahfamili try something like the following where after stats by something is sorted in required order, streamstats can be used to prefix number and then final Trellis layout will sort based on number.

base search 
| stats count by something
| streamstats count as sno
| eval something=sno.":".something

Re: How can I change the sort order of data in a Trellis chart?

take001 — Fri, 15 Jun 2018 03:05:54 GMT

I changed a bit so that I can sort even if there are more than 10 items.

 base search 
 | stats count by something
 | streamstats count as sno
 |eval sn=printf("%04d",sn)
 | eval something=sno.":".something
 |stats values(count) by something

Re: How can I change the sort order of data in a Trellis chart?

kgup0003 — Wed, 19 Dec 2018 23:14:50 GMT

Has anyone solved this yet? I am also trying to display trellis values in a particular order. I have used something what @harishalipaka suggested and it works well for Statistics option but trellis values are still sorted in alphabetical order.

Re: How can I change the sort order of data in a Trellis chart?

cblanton — Tue, 23 Jul 2019 20:50:16 GMT

documentation still includes this instruction, but still doesn't work.

https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/Viz/VisualizationTrellis#Trellis_layout_and_dashboard_display

Re: How can I change the sort order of data in a Trellis chart?

marksmeltzer — Fri, 15 Nov 2019 19:06:35 GMT

It is still not possible to sort trellis panels using cloud hosted version 7.0.8.5...,Sorting in Trellis view still doesn't work in cloud hosted 7.0.8.5 😕

Re: How can I change the sort order of data in a Trellis chart?

marksmeltzer — Fri, 15 Nov 2019 19:14:18 GMT

I can confirm it still doesn't work in cloud hosted v7.0.8.5...

Re: How can I change the sort order of data in a Trellis chart?

emeelan_splunk — Wed, 20 Nov 2019 16:37:06 GMT

Hi Folks,
We're working on an exciting new Dashboard Framework. It's currently in beta in Splunkbase here: https://splunkbase.splunk.com/app/4710/
The documentation is here: https://docs.splunk.com/Documentation/DashApp/0.2.0/DashApp/IntroApp

Trellis is not yet a feature in this beta version, but we're working on it, and when it's added, we'll fix the sort problems in the new app. I can't give you a timeline, but keep an eye out for beta version updates that will happen often. I suggest checking out the app, the visual editor is completely re-imagined and really new. As we add features, it'll become very powerful. You can even convert most existing Simple XML dashboards (the new source code is JSON) to the new framework (as long as the features are supported).

Please check it out and give us some feedback. We think you'll be pleasantly surprised.

Re: How can I change the sort order of data in a Trellis chart?

MuS — Tue, 16 Jun 2020 04:15:29 GMT

Hi @niketn

Your approach got me towards the result I wanted! I ended up with this run everywhere example to sort the pie chart trellis sorted the way I needed them

| tstats count WHERE index=_* by index sourcetype | eval my_range=case(count > 0 AND count < 500, 1,count > 500 AND count < 1000, 2,count > 1000 AND count < 2000, 3, 1=1, 10) | stats dc(sourcetype) AS st dc(index) AS idx by my_range | sort - my_range | streamstats count as sno | eval something=sno.". ".my_range | stats sum(st) AS st sum(idx) AS idx by something

Thanks and I hope this will help some one else while we wait for the fix ...

cheers, MuS

Re: How can I change the sort order of data in a Trellis chart?

terminaloutcome — Mon, 06 Sep 2021 05:21:00 GMT

There's another option that works if you're looking to do some simple sorting.

| makeresults 
| eval name="Alice,Bob,Frank,Steve" 
| makemv delim="," name 
| mvexpand name 
| eval fakenumber=len(name)
| eval sorted_name=if(name=="Frank"," Frank",name)
| eval sorted_name=if(sorted_name=="Steve","  Steve",sorted_name)
| stats max(fakenumber) as namelen by sorted_name

It'll put the trellis in the order of Steve, Frank, Alice, Bob. There's two spaces before "Steve" and one before "Frank"