Dashboards & Visualizations

Add drilldown and get fieldname from trellis layout in splunk?

Poojitha
Path Finder

Hi All,

I am working on the dashboard which makes use of trellis layout. Below is the query I am using :

 

 

index="_internal" sourcetype="test" source="*test.log*" 
| rename host as ipaddress
| join ipaddress
[ |inputlookup activemachines.csv
| fields ipaddress]
| stats dc(ipaddress) as instances_sentinel_installed
| appendcols
[ |inputlookup activemachines.csv
| stats count(ipaddress) as total_machines ]
| eval Percent=round((instances_sentinel_installed/total_machines)*100,2)
| rename total_machines as "Total Active Machines" instances_sentinel_installed as "Instances with Sentinel Installed"
| table "Total Active Machines" "Instances with Sentinel Installed" Percent

 

 


The trellis layout looks like I have shared in screenshot.
2129 is "Total Active Machines"
502 is "Instances with Sentinel Installed"
24 is Percentage

I have to use field name on click of the trellis. ex : If I click on 2129 I should get this "Total Active Machines" fieldname and this one I am using in the custom link.

I tried this and few more like click.name, click.name2, click.value and so.
<drilldown>
<set token="tokName">$trellis.value$</set>
<link target="_blank">search?asdasdasd$tokName$&amp;earliest=-60m%40m&amp;latest=now</link>
</drilldown>
With trellis.value, I am getting field value i.e 2129 but I want fieldname.

Please anyone help me on this. I appreciate your response.

Thanks in advance,
NVP

Labels (5)
0 Karma

bowesmana
SplunkTrust
SplunkTrust
0 Karma

Poojitha
Path Finder

I tried that still not getting fieldname , instead am getting  as "result "

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Mmm, I am also having some strange results with trellis tokens...

I am not a big fan of trellis - I prefer using Chris Younger's number viz, which does trellis on its own and is really customisable.

https://splunkbase.splunk.com/app/4537

 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...