I've been playing around with the new trellis dashboard layout. In the search we have different levels of errors, like Severity Level 1, 2, 3, etc.
Is there any way to order the way the cards show up? So we can show Level 1, then 2 then three from left to right?
Seems like they default to alphabetical no matter how you sort them in the search.
This should be determined by the sort order for your data. However, there seems to be an issue with it. If you look at the bottom of the page in the docs, you see some communication regarding sort not working for the order of the trellis panels, only for the data in the table at the bottom. The last comment was from June 28th regarding the issue.
The sort command issue is SPL-142769
Frobinson splunk, Splunker
June 28, 2017
From the docs:
To change the order in which segments appear, adjust the search to sort or change search result order.
Has anyone solved this yet? I have the same problem trying to change the sort order. Currently I just something like this:
base search | stats count by something| table field1 field2 field3 field4
to force the sorting. It is not ideal cos if the "something" fields has a new variable, It will not be displayed.
can you try like this
|eval sortingtable=if(Level="level 1",1,if(Level="level 2",2,case(Level="level 3",3))) | sort sortingtable
@quahfamili try something like the following where after stats by something is sorted in required order, streamstats can be used to prefix number and then final Trellis layout will sort based on number.
base search | stats count by something | streamstats count as sno | eval something=sno.":".something
Your approach got me towards the result I wanted! I ended up with this run everywhere example to sort the pie chart trellis sorted the way I needed them
| tstats count WHERE index=_* by index sourcetype | eval my_range=case(count > 0 AND count < 500, 1,count > 500 AND count < 1000, 2,count > 1000 AND count < 2000, 3, 1=1, 10) | stats dc(sourcetype) AS st dc(index) AS idx by my_range | sort - my_range | streamstats count as sno | eval something=sno.". ".my_range | stats sum(st) AS st sum(idx) AS idx by something
Thanks and I hope this will help some one else while we wait for the fix ...
I changed a bit so that I can sort even if there are more than 10 items.
base search | stats count by something | streamstats count as sno |eval sn=printf("%04d",sn) | eval something=sno.":".something |stats values(count) by something
Has anyone solved this yet? I am also trying to display trellis values in a particular order. I have used something what @harishalipaka suggested and it works well for Statistics option but trellis values are still sorted in alphabetical order.