Dashboards & Visualizations

How to split query result like using Trellis of Visualizatoin in search in Dashboard Studio

mihir_hardas
Explorer

A search query in Dashobard Classic when split by Trellis in Visualization tab i  gives 4 pie charts 

index=log-13120-nonprod-c laas_appId=qbmp.prediction* "jobPredictionAnalysis" prediction lastEndDelta
| eval accuracy_category = case( abs(lastEndDelta) <= 600, 10, (abs(lastEndDelta) > 600 and abs(lastEndDelta) <= 1200), 20, (abs(lastEndDelta) > 1200 and abs(lastEndDelta) <= 1800), 30, 1==1,40)
| eval timeDistance_category = case(timeDistance < 3600, 1, (timeDistance>3600 and timeDistance<7200),2,(timeDistance>7200 and timeDistance<10800),3,1==1,4)

| chart count by accuracy_category

 

But if the same is embedded in Dashboard Studio I have to add a where clause to create the query result in 4 parts to get 4 pie charts becuase I cannot find Trellis option.


How to get 4 piecharts ( split by ... Trellis ) in Dashboard Studio ?

| where timeDistance_category=1

Labels (1)
Tags (1)
0 Karma

mihir_hardas
Explorer

Thank you for your note. Since Trellis is not available in Dashboard Studio, what should be a good recommended workaround ?

0 Karma

somesoni2
Revered Legend

I've not got a chance to play around with it, but I believe best option would be to use chained searches (similar to post-process in Classic dashboard). This way you'd be running one main search and then filter/branch out results from that search (in your case, different where clause). See more here:

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2202/DashStudio/dsChain

0 Karma

somesoni2
Revered Legend

Trellies are not supported on Dashboard Studio and AFAIK,  there are no alternatives yet.

0 Karma
Get Updates on the Splunk Community!

Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today

Meet Carol Wright. She leads the Splunk Academic Alliance program at Splunk. The Splunk Academic Alliance ...

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...