Dashboards & Visualizations

How can I change the sort order of data in a Trellis chart?

ejharts2015
Communicator

I've been playing around with the new trellis dashboard layout. In the search we have different levels of errors, like Severity Level 1, 2, 3, etc.

Is there any way to order the way the cards show up? So we can show Level 1, then 2 then three from left to right?

Seems like they default to alphabetical no matter how you sort them in the search.

terminaloutcome
Path Finder

There's another option that works if you're looking to do some simple sorting.

| makeresults 
| eval name="Alice,Bob,Frank,Steve" 
| makemv delim="," name 
| mvexpand name 
| eval fakenumber=len(name)
| eval sorted_name=if(name=="Frank"," Frank",name)
| eval sorted_name=if(sorted_name=="Steve","  Steve",sorted_name)
| stats max(fakenumber) as namelen by sorted_name

It'll put the trellis in the order of Steve, Frank, Alice, Bob. There's two spaces before "Steve" and one before "Frank"

 

Screen Shot 2021-09-06 at 15.18.41.pngScreen Shot 2021-09-06 at 15.18.32.png

0 Karma

emeelan_splunk
Splunk Employee
Splunk Employee

Hi Folks,
We're working on an exciting new Dashboard Framework. It's currently in beta in Splunkbase here: https://splunkbase.splunk.com/app/4710/
The documentation is here: https://docs.splunk.com/Documentation/DashApp/0.2.0/DashApp/IntroApp

Trellis is not yet a feature in this beta version, but we're working on it, and when it's added, we'll fix the sort problems in the new app. I can't give you a timeline, but keep an eye out for beta version updates that will happen often. I suggest checking out the app, the visual editor is completely re-imagined and really new. As we add features, it'll become very powerful. You can even convert most existing Simple XML dashboards (the new source code is JSON) to the new framework (as long as the features are supported).

Please check it out and give us some feedback. We think you'll be pleasantly surprised.

0 Karma

marksmeltzer
New Member

It is still not possible to sort trellis panels using cloud hosted version 7.0.8.5...,Sorting in Trellis view still doesn't work in cloud hosted 7.0.8.5 😕

0 Karma

kgup0003
New Member

Has anyone solved this yet? I am also trying to display trellis values in a particular order. I have used something what @harishalipaka suggested and it works well for Statistics option but trellis values are still sorted in alphabetical order.

0 Karma

take001
New Member

I changed a bit so that I can sort even if there are more than 10 items.

 base search 
 | stats count by something
 | streamstats count as sno
 |eval sn=printf("%04d",sn)
 | eval something=sno.":".something
 |stats values(count) by something
0 Karma

quahfamili
Path Finder

Has anyone solved this yet? I have the same problem trying to change the sort order. Currently I just something like this:

base search | stats count by something| table field1 field2 field3 field4

to force the sorting. It is not ideal cos if the "something" fields has a new variable, It will not be displayed.

0 Karma

niketn
Legend

@quahfamili try something like the following where after stats by something is sorted in required order, streamstats can be used to prefix number and then final Trellis layout will sort based on number.

base search 
| stats count by something
| streamstats count as sno
| eval something=sno.":".something
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

MuS
SplunkTrust
SplunkTrust

Hi @niketn 

Your approach got me towards the result I wanted! I ended up with this run everywhere example to sort the pie chart trellis sorted the way I needed them

| tstats count WHERE index=_* by index sourcetype 
| eval my_range=case(count > 0 AND count < 500, 1,count > 500 AND count < 1000, 2,count > 1000 AND count < 2000, 3, 1=1, 10) 
| stats dc(sourcetype) AS st dc(index) AS idx by my_range 
| sort - my_range 
| streamstats count as sno 
| eval something=sno.". ".my_range 
| stats sum(st) AS st sum(idx) AS idx by something

 

Thanks and I hope this will help some one else while we wait for the fix ...

cheers, MuS

0 Karma

harishalipaka
Motivator

Hi @quahfamili
can you try like this

|eval sortingtable=if(Level="level 1",1,if(Level="level 2",2,case(Level="level 3",3))) | sort sortingtable 
Thanks
Harish
0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

This should be determined by the sort order for your data. However, there seems to be an issue with it. If you look at the bottom of the page in the docs, you see some communication regarding sort not working for the order of the trellis panels, only for the data in the table at the bottom. The last comment was from June 28th regarding the issue.

The sort command issue is SPL-142769
Frobinson splunk, Splunker
June 28, 2017

From the docs:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Viz/VisualizationTrellis
To change the order in which segments appear, adjust the search to sort or change search result order.

cblanton
Communicator

documentation still includes this instruction, but still doesn't work.

https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/Viz/VisualizationTrellis#Trellis_layout_and_...

0 Karma

marksmeltzer
New Member

I can confirm it still doesn't work in cloud hosted v7.0.8.5...

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...