topic Re: Add drilldown and get fieldname from trellis layout in splunk in Dashboards & Visualizations

Add drilldown and get fieldname from trellis layout in splunk?

Poojitha — Tue, 28 Feb 2023 15:05:01 GMT

Hi All,

I am working on the dashboard which makes use of trellis layout. Below is the query I am using :

index="_internal" sourcetype="test" source="*test.log*" | rename host as ipaddress | join ipaddress [ |inputlookup activemachines.csv | fields ipaddress] | stats dc(ipaddress) as instances_sentinel_installed | appendcols [ |inputlookup activemachines.csv | stats count(ipaddress) as total_machines ] | eval Percent=round((instances_sentinel_installed/total_machines)*100,2) | rename total_machines as "Total Active Machines" instances_sentinel_installed as "Instances with Sentinel Installed" | table "Total Active Machines" "Instances with Sentinel Installed" Percent

The trellis layout looks like I have shared in screenshot.
2129 is "Total Active Machines"
502 is "Instances with Sentinel Installed"
24 is Percentage

I have to use field name on click of the trellis. ex : If I click on 2129 I should get this "Total Active Machines" fieldname and this one I am using in the custom link.

I tried this and few more like click.name, click.name2, click.value and so.
<drilldown>
<set token="tokName">$trellis.value$</set>
<link target="_blank">search?asdasdasd$tokName$&earliest=-60m%40m&latest=now</link>
</drilldown>
With trellis.value, I am getting field value i.e 2129 but I want fieldname.

Please anyone help me on this. I appreciate your response.

Thanks in advance,
NVP

Re: Add drilldown and get fieldname from trellis layout in splunk

bowesmana — Mon, 27 Feb 2023 22:38:25 GMT

Use $trellis.name$ for name and value for value.

https://docs.splunk.com/Documentation/Splunk/9.0.2/Viz/VisualizationTrellis#Predefined_tokens_for_trellis_split_fields

Re: Add drilldown and get fieldname from trellis layout in splunk

Poojitha — Tue, 28 Feb 2023 06:06:00 GMT

I tried that still not getting fieldname , instead am getting as "result "

Re: Add drilldown and get fieldname from trellis layout in splunk

bowesmana — Tue, 28 Feb 2023 07:34:45 GMT

Mmm, I am also having some strange results with trellis tokens...

I am not a big fan of trellis - I prefer using Chris Younger's number viz, which does trellis on its own and is really customisable.

https://splunkbase.splunk.com/app/4537