Dashboards & Visualizations

Add drilldown and get fieldname from trellis layout in splunk?

Path Finder

Hi All,

I am working on the dashboard which makes use of trellis layout. Below is the query I am using :



index="_internal" sourcetype="test" source="*test.log*" 
| rename host as ipaddress
| join ipaddress
[ |inputlookup activemachines.csv
| fields ipaddress]
| stats dc(ipaddress) as instances_sentinel_installed
| appendcols
[ |inputlookup activemachines.csv
| stats count(ipaddress) as total_machines ]
| eval Percent=round((instances_sentinel_installed/total_machines)*100,2)
| rename total_machines as "Total Active Machines" instances_sentinel_installed as "Instances with Sentinel Installed"
| table "Total Active Machines" "Instances with Sentinel Installed" Percent



The trellis layout looks like I have shared in screenshot.
2129 is "Total Active Machines"
502 is "Instances with Sentinel Installed"
24 is Percentage

I have to use field name on click of the trellis. ex : If I click on 2129 I should get this "Total Active Machines" fieldname and this one I am using in the custom link.

I tried this and few more like click.name, click.name2, click.value and so.
<set token="tokName">$trellis.value$</set>
<link target="_blank">search?asdasdasd$tokName$&amp;earliest=-60m%40m&amp;latest=now</link>
With trellis.value, I am getting field value i.e 2129 but I want fieldname.

Please anyone help me on this. I appreciate your response.

Thanks in advance,

Labels (5)
0 Karma

0 Karma

Path Finder

I tried that still not getting fieldname , instead am getting  as "result "

0 Karma


Mmm, I am also having some strange results with trellis tokens...

I am not a big fan of trellis - I prefer using Chris Younger's number viz, which does trellis on its own and is really customisable.



0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! &#x1f308; In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...