topic Re: Trellis Search in Splunk Search

Trellis Search

JanetLong — Mon, 29 Nov 2021 09:43:21 GMT

Splunk's VisualizationTrellis documentation page shows example searches for things like count by sourcetype, and later shows trellis-ed visualizations for multi-value items, but there are no example searches for them.

My data looks like this...

{
   audit: {
     audit_enabled: Compliant,
     control_access: NotCompliant,
     firewall_on: NotCompliant,
     etc: ...
}
}

I can create separate searches for each item in audit {} like this...

source=device_audit
| stats count by audit.audit_enabled

But there are many audit items. I'd like to trellis pie charts for each audit item without creating a separate search for each.

Is there are search I can use to trellis to produce three pie charts to show the split between compliant and notCompliant for each of the audit items (audit_enabled/control_access/firewall_on)?

Thank you.

Re: Trellis Search

ITWhisperer — Mon, 29 Nov 2021 10:33:21 GMT

The part before the blank lines sets up some dummy data and should be replace with your search

| makeresults count=100 | eval _raw="{\"audit\":{\"audit_enabled\":\"".mvindex(split("Not|","|"),random()%2)."Compliant\",\"controlled_access\":\"".mvindex(split("Not|","|"),random()%2)."Compliant\",\"firewall_on\":\"".mvindex(split("Not|","|"),random()%2)."Compliant\"}}" | spath | fields - _raw | untable _time audit state | stats count by audit state

Re: Trellis Search

JanetLong — Wed, 01 Dec 2021 06:32:50 GMT

Brilliant. Thanks... I learned a lot from picking that apart.