topic Re: How do you use multiple by fields with a trellis layout? in Splunk Search

How do you use multiple by fields with a trellis layout?

tgdvopab — Mon, 21 Jan 2019 14:51:22 GMT

Hi all,

I want to get the average from a value, group this by cluster and hostname and show the value in a timechart.

With the grid-view, I would like to have one panel for each cluster.

For example:

index=foo sourcetype=bar | timechart avg(Value) by cluster,hostname

And have for each cluster a separate panel.

Is this possible? I know that multiple by fields are possible with the stats-command.

But, I'm not able to group them with the grid view.

Someone can help me please?

Re: How do you use multiple by fields with a trellis layout?

niketn — Mon, 21 Jan 2019 15:47:03 GMT

@tgdvopab, what do you imply by Grid View? If you are on Splunk 6.6 or higher, try to feed the output of following query to Trellis Layout and Split by Cluster as aggregation field.

 index=foo sourcetype=bar 
| bin _time span=1h
| stats count by  cluster,hostname

Re: How do you use multiple by fields with a trellis layout?

niketn — Mon, 21 Jan 2019 16:01:52 GMT

@tgdvopab if your issue is resolved, do go ahead and accept the answer to mark this question as resolved!

Re: How do you use multiple by fields with a trellis layout?

tgdvopab — Tue, 22 Jan 2019 15:24:40 GMT

Thanks for your answer! 🙂
Now I need to have the data from stats in a timechart.
So I think I need also the _time value in stats, for example: stats count by _time,cluster,hostname
But this doesn't work. Do you have an idea?