Dashboards & Visualizations

Is there a way to display more than 20 charts at a time using new trellis layout?

ksarpol
Explorer

I have 30 hosts. I would like to see a chart of all 30 hosts using the trellis layout but only 20 (2 rows of 10 each) are displayed at a time. I know I can use the "Next" link to see the remaining 10 charts but I want to see all 30 at once so I can put it on a operations monitor.

Is there a way to display more than 20 charts using trellis layout?

The documentation makes no mention of any limits.

Limitations
     Fields generated with the eval command appear as aggregations in the trellis layout configuration menu.
     Trellis layout is not available for table visualizations or cluster maps.
     A predefined token is not available for aggregations used for splitting a visualization.
     Visualizations using trellis layout do not render in dashboard PDFs.
Tags (1)
1 Solution

to4kawa
Ultra Champion
<form>
    <label>ups temp</label>
    <search id="trellis">
    <query> index=test NOT failed NOT resource sourcetype=ups_temp 
| dedup object_id 
| eval temp=round(temp_value,2) 
| lookup ups_object_id object_id AS object_id OUTPUT equip_no 
| table temp equip_no 
| sort - temp 
| streamstats count as filter
    </query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
    </search>
    <fieldset submitButton="false">
    <input type="time" token="field1">
    <label></label>
    <default>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    </default>
    </input>
    </fieldset>
    <row>
    <panel>
    <single id="chartPanel1">
    <search base="trellis">
    <query> 
| where filter &gt; 0 AND filter &lt; 21 
| eval tmp="T" 
| xyseries tmp equip_no temp 
| fields - tmp</query>
    </search>
    <option name="drilldown">none</option>
    <option name="trellis.enabled">1</option>
    <option name="height">600</option>
    </single>
    </panel>
    </row>
    <row>
    <panel>
    <single id="chartPanel2">
    <search base="trellis">
    <query> 
| where filter &gt; 20 AND filter &lt; 41 
| eval tmp="T" 
| xyseries tmp equip_no temp 
| fields - tmp</query>
    </search>
    <option name="drilldown">none</option>
    <option name="trellis.enabled">1</option>
    <option name="height">600</option>
    </single>
    </panel>
    </row>
    <row>
    <panel>
    <single id="chartPanel3">
    <search base="trellis">
    <query> 
| where filter &gt; 40 AND filter &lt; 61 
| eval tmp="T" 
| xyseries tmp equip_no temp 
| fields - tmp</query>
    </search>
    <option name="drilldown">none</option>
    <option name="trellis.enabled">1</option>
    <option name="height">600</option>
    </single>
    </panel>
    </row>
    <row>
    <panel>
    <single id="chartPanel4">
    <search base="trellis">
    <query> 
| where filter &gt; 60 AND filter &lt; 81 
| eval tmp="T" 
| xyseries tmp equip_no temp 
| fields - tmp</query>
    </search>
    <option name="drilldown">none</option>
    <option name="trellis.enabled">1</option>
    <option name="height">600</option>
    </single>
    </panel>
    </row>
    <row>
    <panel>
    <single id="chartPanel5">
    <search base="trellis">
    <query> 
| where filter &gt; 80 AND filter &lt; 101 
| eval tmp="T" 
| xyseries tmp equip_no temp 
| fields - tmp</query>
    </search>
    <option name="drilldown">none</option>
    <option name="trellis.enabled">1</option>
    <option name="height">600</option>
    </single>
    </panel>
    </row>
    <row>
    <panel>
    <single id="chartPanel6">
    <search base="trellis">
    <query> 
| where filter &gt; 100 AND filter &lt; 121 
| eval tmp="T" 
| xyseries tmp equip_no temp 
| fields - tmp</query>
    </search>
    <option name="drilldown">none</option>
    <option name="trellis.enabled">1</option>
    <option name="height">600</option>
    </single>
    </panel>
    </row>
    <row>
    <panel>
    <single id="chartPanel7">
    <search base="trellis">
    <query> 
| where filter &gt; 120 AND filter &lt; 141 
| eval tmp="T" 
| xyseries tmp equip_no temp 
| fields - tmp</query>
    </search>
    <option name="drilldown">none</option>
    <option name="trellis.enabled">1</option>
    <option name="height">600</option>
    </single>
    </panel>
    </row>
    <row>
    <panel>
    <single id="chartPanel8">
    <search base="trellis">
    <query> 
| where filter &gt; 140 AND filter &lt; 161 
| eval tmp="T" 
| xyseries tmp equip_no temp 
| fields - tmp</query>
    </search>
    <option name="drilldown">none</option>
    <option name="trellis.enabled">1</option>
    <option name="height">600</option>
    </single>
    </panel>
    </row>
    </form>

Hi, @pgadhari
I haven't tried it, but I made it.

View solution in original post

0 Karma

pgadhari
Builder

@woodcock @niketnilay Is there any solution for this problem. I am also facing the same issue ? I want to show 156 hosts in a single panel on a single page. Please help ?

0 Karma

woodcock
Esteemed Legend

See my new answer.

0 Karma

fsolercasanova
Explorer

A simple workaround that you might be willing to implement:

You can create a base search and have two trellis panels based off it in separate rows. Pull the 20 hosts for Trellis Panel 1 and exclude those same hosts from Trellis Panel 2. If the number of hosts goes up this can just be chained every time one of the trellis panels reaches the maximum limit.

https://docs.splunk.com/Documentation/Splunk/7.2.6/Viz/Savedsearches#Post-process_searches

efavreau
Motivator

At the time of this answer, I was not able to find a way. In the latest documentation, http://docs.splunk.com/Documentation/Splunk/7.2.0/Viz/ChartConfigurationReference and http://docs.splunk.com/Documentation/Splunk/7.2.0/Viz/VisualizationTrellis, there is the following:

Use the Trellis menu to adjust the segment size and show more segments in the panel. You can also use the dashboard editor to drag the panel size or change the panel height option in Simple XML.

I added the following into my simple xml dashboard panel source:

<option name="charting.data.count">0</option>
<option name="height">10000</option>

The panel height maximum limit is documented at 10000, which made for a quite large panel. However, the trellis still stopped at 20, and did not fill the panel. It would appear we have reached a physical limit with no known workaround/override.

###

If this reply helps you, an upvote would be appreciated.
0 Karma

niketn
Legend

@efavreau, I have have converted your Answer to comment as it does not have a solution.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

efavreau
Motivator

@niketnilay Thank you! Appreciate your help - as always.

###

If this reply helps you, an upvote would be appreciated.
0 Karma

joshuayourth
Explorer

I'm in the same boat as you. I have 22 hosts that I'm monitoring, so I have 20 on one page, and then a tab of 2 more. Quite annoying.

0 Karma

I868162
Explorer

Hi @ksarpol and @joshuayourth,

Did you ever find the solution to this?

0 Karma

ksarpol
Explorer

I did not. 😞

0 Karma

AnilPujar
Path Finder

Yes, same problem ... there should be some option to increase the trellis limit per page.

As each row will display 6 viz per row, so it will look like :

VIZ VIZ VIZ VIZ VIZ VIZ
VIZ VIZ VIZ VIZ VIZ VIZ
VIZ VIZ
<1,2>
I have 21 Sourcetypes, so just for one more viz i need to click 2nd page, when there are places in the first screen itself.

DalJeanis
Legend

None of the demos showed more than two rows of segments, so they may not have anticipated the need for three... which seems odd...

Here's the only note I found that might be helpful... from the same page - https://docs.splunk.com/Documentation/Splunk/latest/Viz/VisualizationTrellis

Use the Trellis menu to adjust the segment size and show more segments in the panel. You can also use the dashboard editor to drag the panel size or change the panel height option in Simple XML.

I assume you already set the segments as small, so playing with the XML height is the only obvious option.

0 Karma

niketn
Legend

@DalJeanis, rather than showing results in two rows, I believe the current settings are showing "20 results/splits per page" similar to what table has by default (20 rows /50 rows or 100 rows per page). I feel there should be an enhancement to Trellis Layout to have the options to switch between 20 results/50 results etc.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

jtrujillo
Path Finder

I upvoted this. It should 100% be configurable in the trellis options...

0 Karma

rithvikmundra
Explorer

I definitely agree with @niketnilay. We need more than 20 results in a trellis layout.

0 Karma

bandit
Motivator

Yes, please up trellis limit and add sort option

0 Karma

ksarpol
Explorer

Thanks for responding. I am using "small" size and changing the panel size seems to have no effect. I'm going to have to create 2 panels with 15 in each to get what I'm looking for. Splunk developers seems have a habit of releasing new features that are half-baked.

dijikul
Communicator

This right here seems to hit the nail on the head. I was shocked to learn the deprecation of Advanced XML in Splunk 7 prevents me from shading an area chart with a gradient - easily achievable with CSS, but having to explort dashboards to HTML to customize is huge workflow overhead for turning around quick (and pretty) visualization in compared to some other tools.

Splunk wins in terms of obtaining access to data and making it available, but presentation is definitely not it's strength.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...