Dashboards & Visualizations

How can I change the sort order of data in a Trellis chart?

Communicator

I've been playing around with the new trellis dashboard layout. In the search we have different levels of errors, like Severity Level 1, 2, 3, etc.

Is there any way to order the way the cards show up? So we can show Level 1, then 2 then three from left to right?

Seems like they default to alphabetical no matter how you sort them in the search.

Splunk Employee
Splunk Employee

Hi Folks,
We're working on an exciting new Dashboard Framework. It's currently in beta in Splunkbase here: https://splunkbase.splunk.com/app/4710/
The documentation is here: https://docs.splunk.com/Documentation/DashApp/0.2.0/DashApp/IntroApp

Trellis is not yet a feature in this beta version, but we're working on it, and when it's added, we'll fix the sort problems in the new app. I can't give you a timeline, but keep an eye out for beta version updates that will happen often. I suggest checking out the app, the visual editor is completely re-imagined and really new. As we add features, it'll become very powerful. You can even convert most existing Simple XML dashboards (the new source code is JSON) to the new framework (as long as the features are supported).

Please check it out and give us some feedback. We think you'll be pleasantly surprised.

0 Karma

New Member

It is still not possible to sort trellis panels using cloud hosted version 7.0.8.5...,Sorting in Trellis view still doesn't work in cloud hosted 7.0.8.5 😕

0 Karma

New Member

Has anyone solved this yet? I am also trying to display trellis values in a particular order. I have used something what @harishalipaka suggested and it works well for Statistics option but trellis values are still sorted in alphabetical order.

0 Karma

New Member

I changed a bit so that I can sort even if there are more than 10 items.

 base search 
 | stats count by something
 | streamstats count as sno
 |eval sn=printf("%04d",sn)
 | eval something=sno.":".something
 |stats values(count) by something
0 Karma

Path Finder

Has anyone solved this yet? I have the same problem trying to change the sort order. Currently I just something like this:

base search | stats count by something| table field1 field2 field3 field4

to force the sorting. It is not ideal cos if the "something" fields has a new variable, It will not be displayed.

0 Karma

SplunkTrust
SplunkTrust

@quahfamili try something like the following where after stats by something is sorted in required order, streamstats can be used to prefix number and then final Trellis layout will sort based on number.

base search 
| stats count by something
| streamstats count as sno
| eval something=sno.":".something
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

SplunkTrust
SplunkTrust

Hi @niketnilay 

Your approach got me towards the result I wanted! I ended up with this run everywhere example to sort the pie chart trellis sorted the way I needed them

| tstats count WHERE index=_* by index sourcetype 
| eval my_range=case(count > 0 AND count < 500, 1,count > 500 AND count < 1000, 2,count > 1000 AND count < 2000, 3, 1=1, 10) 
| stats dc(sourcetype) AS st dc(index) AS idx by my_range 
| sort - my_range 
| streamstats count as sno 
| eval something=sno.". ".my_range 
| stats sum(st) AS st sum(idx) AS idx by something

 

Thanks and I hope this will help some one else while we wait for the fix ...

cheers, MuS

0 Karma

Hi @quahfamili
can you try like this

|eval sortingtable=if(Level="level 1",1,if(Level="level 2",2,case(Level="level 3",3))) | sort sortingtable 
0 Karma

Splunk Employee
Splunk Employee

This should be determined by the sort order for your data. However, there seems to be an issue with it. If you look at the bottom of the page in the docs, you see some communication regarding sort not working for the order of the trellis panels, only for the data in the table at the bottom. The last comment was from June 28th regarding the issue.

The sort command issue is SPL-142769
Frobinson splunk, Splunker
June 28, 2017

From the docs:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Viz/VisualizationTrellis
To change the order in which segments appear, adjust the search to sort or change search result order.

Communicator

documentation still includes this instruction, but still doesn't work.

https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/Viz/VisualizationTrellis#Trellis_layout_and_...

0 Karma

New Member

I can confirm it still doesn't work in cloud hosted v7.0.8.5...

0 Karma