Hi, I'm trying to convert my classic dashboard to studio, and one of my bar charts is in trellis layout. For context this is my code:
index
| search tenant = "*"
| dedup id, tenant
| stats count as total_devices by tenant
| join type=left [index
| dedup id, tenant | where time > (now()-86400) | stats count as available_devices by tenant]
| eval available_devices = if(isnull(available_devices) OR available_devices="", "0", available_devices)
| eval unavailable_devices = total_devices - available_devices
Ideally, the trellis layout will separate the results by tenant. However, when I use the splitSeries option, it separates into total_devices, available_devices, and unavailable_devices instead.
Thanks! Any help will be appreciated.