Dashboards & Visualizations

Enhance Trellis chart with text from a lookup

jhuysing
Loves-to-Learn Lots

I have a search from which i produce a trellis of  the sum of various error codes from multiple machines 
I would like to enhance the charts  with a short description of text.
I  could  add the text to the code value  and create a new  value name  and do the split on the new  "codetext".
But, then I can't use the drill down  feature.

Is there another way to add some text to the individual graphs

Labels (3)
0 Karma

jhuysing
Loves-to-Learn Lots

I have been fiddling around trying to us a eval to strip the phrase from the passed  value

With no luck

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Not sure what you are trying to express.  This is what YOU come up with

| rex field=Error_Text".*:\s(?P<Code>\d{3})"
| lookup error_codes Code OUTPUT Phrase
| eval CodePhrase = Code+" -- "+Phrase

Does this add Phrase to your trellis label or not?  I bet this does.  If it does, what's wrong with this method? 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Why can't you use the drilldown feature?

0 Karma

jhuysing
Loves-to-Learn Lots

Sorry been busy with other work

Maybe I  am doing this wrong
The only way I could figure out how  give a bit more information in  a graph was  to  join the code  and phrase and then use that in the Split By in the Trellis

| rex field=Error_Text".*:\s(?P<Code>\d{3})"
| lookup error_codes Code OUTPUT Phrase
| eval CodePhrase = Code+" -- "+Phrase


When I use the Drill down it using joined  "codephrase"  field.

So I am wondering if there is another way to add the text  to  the graphs

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Is there anything wrong with the method you already use?  Or is there a specific effect this is not giving you?

If you think it through, trellis has only one single variable for breakdown and display.  All you can do is to change this value.  You search already does that.  If it ain't broken and disclaimers😃

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...