Dashboards & Visualizations
Highlighted

How can I change the sort order of data in a Trellis chart?

Communicator

I've been playing around with the new trellis dashboard layout. In the search we have different levels of errors, like Severity Level 1, 2, 3, etc.

Is there any way to order the way the cards show up? So we can show Level 1, then 2 then three from left to right?

Seems like they default to alphabetical no matter how you sort them in the search.

Highlighted

Re: How can I change the sort order of data in a Trellis chart?

Motivator

This should be determined by the sort order for your data. However, there seems to be an issue with it. If you look at the bottom of the page in the docs, you see some communication regarding sort not working for the order of the trellis panels, only for the data in the table at the bottom. The last comment was from June 28th regarding the issue.

The sort command issue is SPL-142769
Frobinson splunk, Splunker
June 28, 2017

From the docs:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Viz/VisualizationTrellis
To change the order in which segments appear, adjust the search to sort or change search result order.

Highlighted

Re: How can I change the sort order of data in a Trellis chart?

Communicator

documentation still includes this instruction, but still doesn't work.

https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/Viz/VisualizationTrellis#Trellis_layout_and_...

0 Karma
Highlighted

Re: How can I change the sort order of data in a Trellis chart?

New Member

I can confirm it still doesn't work in cloud hosted v7.0.8.5...

0 Karma
Highlighted

Re: How can I change the sort order of data in a Trellis chart?

Path Finder

Has anyone solved this yet? I have the same problem trying to change the sort order. Currently I just something like this:

base search | stats count by something| table field1 field2 field3 field4

to force the sorting. It is not ideal cos if the "something" fields has a new variable, It will not be displayed.

0 Karma
Highlighted

Re: How can I change the sort order of data in a Trellis chart?

Hi @quahfamili
can you try like this

|eval sortingtable=if(Level="level 1",1,if(Level="level 2",2,case(Level="level 3",3))) | sort sortingtable 
0 Karma
Highlighted

Re: How can I change the sort order of data in a Trellis chart?

Legend

@quahfamili try something like the following where after stats by something is sorted in required order, streamstats can be used to prefix number and then final Trellis layout will sort based on number.

base search 
| stats count by something
| streamstats count as sno
| eval something=sno.":".something



| eval message="Happy Splunking!!!"


Highlighted

Re: How can I change the sort order of data in a Trellis chart?

SplunkTrust
SplunkTrust

Hi @niketnilay 

Your approach got me towards the result I wanted! I ended up with this run everywhere example to sort the pie chart trellis sorted the way I needed them

| tstats count WHERE index=_* by index sourcetype 
| eval my_range=case(count > 0 AND count < 500, 1,count > 500 AND count < 1000, 2,count > 1000 AND count < 2000, 3, 1=1, 10) 
| stats dc(sourcetype) AS st dc(index) AS idx by my_range 
| sort - my_range 
| streamstats count as sno 
| eval something=sno.". ".my_range 
| stats sum(st) AS st sum(idx) AS idx by something

 

Thanks and I hope this will help some one else while we wait for the fix ...

cheers, MuS

0 Karma
Highlighted

Re: How can I change the sort order of data in a Trellis chart?

New Member

I changed a bit so that I can sort even if there are more than 10 items.

 base search 
 | stats count by something
 | streamstats count as sno
 |eval sn=printf("%04d",sn)
 | eval something=sno.":".something
 |stats values(count) by something
0 Karma
Highlighted

Re: How can I change the sort order of data in a Trellis chart?

New Member

Has anyone solved this yet? I am also trying to display trellis values in a particular order. I have used something what @harishalipaka suggested and it works well for Statistics option but trellis values are still sorted in alphabetical order.

0 Karma