All Apps and Add-ons

Waterfall Custom Visualization App and Trellised data

jlr
Explorer

I'm wanting to produce a variable, large number of Waterfall charts all with the same format and source data. Is it possible to do this in a Trellis with a Waterfall chart using this app? If not, what would be needed to improve it to do so, or is there an alternate app that can do it?
Example data generated as follows:

| makeresults 
| eval
  2019-01="1,2,3",
  2019-02="1,2,3",
  2019-03="2,2,2",
  2019-04="-1,0,1"
| fields - _time
| transpose 0 column_name="month"
| rex field="row 1" "(?<dat1>.+),(?<dat2>.+),(?<dat3>.+)"
| fields month dat*
| addcoltotals labelfield="month" label="Total"

Adding a | fields month dat1 shows a single valid Waterfall chart, but I'd ideally like to see a way of having the above data create 3 Trellised Waterfall charts (or in the case of my dataset, a trellissed chart per dat* column). In order to get this working with this app I'd have to create a panel per chart with visibility triggers on each, which isn't as desirable.

0 Karma
Get Updates on the Splunk Community!

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...

Enterprise Security Content Update (ESCU) | New Releases

In October, the Splunk Threat Research Team had one release of new security content via the Enterprise ...