topic Re: Can i create trellies wiht overlays, when the overlap can by dynamic. in Dashboards & Visualizations

Can i create trellis with overlays, when the overlap can be dynamic.

robertlynch2020 — Tue, 04 Nov 2025 10:49:30 GMT

I have an issue with a graph like this.

I have created a way to make the overlays dynamic. So we can see multiple levels in the image.

But ideally, I want this in trellies.

Maxcount is the overlay

I do this by generating a token, that has all the overlays.

However, if I change this to treilles, it's no good (They all come out in different images).

Ideally, I need them to be grouped Together (By ID). But when you pick trellises, you lose the overlay, and then there is the question of how each graph knows to take what overlay. There is an ID that is the same that might be useful in this case, but I am not sure - any help would be amazing!!!

Below, we can see the overlay in different graphs.

However, when I do it on a small example, the overlays go into one graph - Perhaps it's related to the data?

<panel> <title>Engine Count With MaxCount per Endpoint_Processing</title> <chart> <search> <query>| mstats avg("mx.grid.endpoint.engine.count") as count WHERE "index"="murex_metrics" span=10s AND "mx.env"="$mx_env$" AND service.name="$serviceName$" AND service.namespace="$serviceNamespace$" AND endpoint.name IN ($endpointName$) AND engine.state IN (processing) BY endpoint.name | join type=left endpoint.name [| mstats latest("mx.grid.endpoint.expected_engine.count") prestats=true where index=murex_metrics AND "mx.env"="$mx_env$" AND service.name="$serviceName$" AND service.namespace="$serviceNamespace$" AND endpoint.name IN ($endpointName$) BY endpoint.name | stats latest("mx.grid.endpoint.expected_engine.count") as desiredCount by endpoint.name ] | rename endpoint.name as EndPoint desiredCount as MaxCount | eval {EndPoint}_processing = count | eval {EndPoint}_MaxCount = MaxCount | fields - EndPoint count MaxCount | stats values(*) as * by _time</query> <earliest>$global_time_tok.earliest$</earliest> <latest>$global_time_tok.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">area</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.overlayFields">$Token_CHART_OVERLAY$</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="height">483</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </chart> </panel>

Re: Can i create trellies wiht overlays, when the overlap can by dynamic.

livehybrid — Fri, 31 Oct 2025 16:04:23 GMT

Hi @robertlynch2020

Unfortunately it isnt possible to apply an overlay to a trellis because it splits by each field, therefore you would end up with the overlay field as its own trellis visualisation.

One way you *might* be able to achieve this is using Dashboard Studio and drawing a line graph with you overlay on top of your other charts - it might take a bit of tweaking and adjusting of the axis min/max etc to get the alignment correct but might work!

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Can i create trellies wiht overlays, when the overlap can by dynamic.

robertlynch2020 — Tue, 04 Nov 2025 10:46:46 GMT

Thanks for the Answer on this.

Rob

Re: Can i create trellis with overlays, when the overlap can be dynamic.

tscroggins — Tue, 04 Nov 2025 18:07:58 GMT

Hi @robertlynch2020,

I'll counter @livehybrid here and note that it should work as long as the overlay fields are aggregations from, e.g., chart, mstats, stats, timechart, or xyseries.

Here's a simplified example using internal logs, timechart, and stats:

I've used timechart and untable as a shortcut for continuous time output. The eventstats command allows using a single field as an overlay that's aggregated by one or more categorical fields. The subsequent stats command converts the pre-binned count and maxcount values into aggregates recognized by trellis mode:

The chart uses a global overlay, but because the value is an aggregate, it varies by split-by field.

Re: Can i create trellis with overlays, when the overlap can be dynamic.

tscroggins — Tue, 04 Nov 2025 21:29:18 GMT

Hi @robertlynch2020,

As an aside, you can add the hidden fields normally generated by the predict command to instruct SplunkWeb to draw upper and lower control boundaries in both normal and trellis modes. As before, the fields need to be aggregations:

index=_internal component IN (LicenseUsage Metrics SavedSplunker) | timechart fixedrange=f limit=0 span=5m usenull=f useother=f count by component | untable _time component count ``` calculate stdev and mean, although you can use any statistics ``` | eventstats stdev(count) as s avg(count) as u by component ``` calculate limits from statistics ``` | eval lcl=max(0, u-s), ucl=u+s ``` add hidden fields to produce river chart boundaries ``` | stats max(count) as count max(lcl) as lcl max(ucl) as ucl values(eval(tostring("lcl"))) as _lowercount values(eval(tostring("count"))) as _predictedcount values(eval(tostring("ucl"))) as _uppercount by _time component

Re: Can i create trellis with overlays, when the overlap can be dynamic.

livehybrid — Wed, 05 Nov 2025 12:21:58 GMT

Thanks @tscroggins - I didnt know this so much appreciate your response with example! One to keep in the back pocket 🙂

Will

Re: Can i create trellis with overlays, when the overlap can be dynamic.

robertlynch2020 — Wed, 05 Nov 2025 16:57:24 GMT

Hi - Boths answers are wonderfull -Thanks very much