Dashboards & Visualizations

Is there a way to display more than 20 charts at a time using new trellis layout?

ksarpol
Explorer

I have 30 hosts. I would like to see a chart of all 30 hosts using the trellis layout but only 20 (2 rows of 10 each) are displayed at a time. I know I can use the "Next" link to see the remaining 10 charts but I want to see all 30 at once so I can put it on a operations monitor.

Is there a way to display more than 20 charts using trellis layout?

The documentation makes no mention of any limits.

Limitations
     Fields generated with the eval command appear as aggregations in the trellis layout configuration menu.
     Trellis layout is not available for table visualizations or cluster maps.
     A predefined token is not available for aggregations used for splitting a visualization.
     Visualizations using trellis layout do not render in dashboard PDFs.
Tags (1)

pgadhari
Builder

tag cloud will not be useful, as I have to show both sensor name (ups name) as well as its temperature. I have created a dashboard with custom CSS showing all single value panels using your method of applying filter and showing in separate panels. I am awaiting reply from User for finalizing the look and feel. Attached is the sample dashboard image I have created.

0 Karma

to4kawa
Ultra Champion

I see, it would be hard to see about 150 displays.

0 Karma

Richfez
SplunkTrust
SplunkTrust

Sweet, that looks really nice @rob_jordan, I think such a thing would be very useful in certain cases!

0 Karma

to4kawa
Ultra Champion
<form>
    <label>ups temp</label>
    <search id="trellis">
    <query> index=test NOT failed NOT resource sourcetype=ups_temp 
| dedup object_id 
| eval temp=round(temp_value,2) 
| lookup ups_object_id object_id AS object_id OUTPUT equip_no 
| table temp equip_no 
| sort - temp 
| streamstats count as filter
    </query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
    </search>
    <fieldset submitButton="false">
    <input type="time" token="field1">
    <label></label>
    <default>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    </default>
    </input>
    </fieldset>
    <row>
    <panel>
    <single id="chartPanel1">
    <search base="trellis">
    <query> 
| where filter &gt; 0 AND filter &lt; 21 
| eval tmp="T" 
| xyseries tmp equip_no temp 
| fields - tmp</query>
    </search>
    <option name="drilldown">none</option>
    <option name="trellis.enabled">1</option>
    <option name="height">600</option>
    </single>
    </panel>
    </row>
    <row>
    <panel>
    <single id="chartPanel2">
    <search base="trellis">
    <query> 
| where filter &gt; 20 AND filter &lt; 41 
| eval tmp="T" 
| xyseries tmp equip_no temp 
| fields - tmp</query>
    </search>
    <option name="drilldown">none</option>
    <option name="trellis.enabled">1</option>
    <option name="height">600</option>
    </single>
    </panel>
    </row>
    <row>
    <panel>
    <single id="chartPanel3">
    <search base="trellis">
    <query> 
| where filter &gt; 40 AND filter &lt; 61 
| eval tmp="T" 
| xyseries tmp equip_no temp 
| fields - tmp</query>
    </search>
    <option name="drilldown">none</option>
    <option name="trellis.enabled">1</option>
    <option name="height">600</option>
    </single>
    </panel>
    </row>
    <row>
    <panel>
    <single id="chartPanel4">
    <search base="trellis">
    <query> 
| where filter &gt; 60 AND filter &lt; 81 
| eval tmp="T" 
| xyseries tmp equip_no temp 
| fields - tmp</query>
    </search>
    <option name="drilldown">none</option>
    <option name="trellis.enabled">1</option>
    <option name="height">600</option>
    </single>
    </panel>
    </row>
    <row>
    <panel>
    <single id="chartPanel5">
    <search base="trellis">
    <query> 
| where filter &gt; 80 AND filter &lt; 101 
| eval tmp="T" 
| xyseries tmp equip_no temp 
| fields - tmp</query>
    </search>
    <option name="drilldown">none</option>
    <option name="trellis.enabled">1</option>
    <option name="height">600</option>
    </single>
    </panel>
    </row>
    <row>
    <panel>
    <single id="chartPanel6">
    <search base="trellis">
    <query> 
| where filter &gt; 100 AND filter &lt; 121 
| eval tmp="T" 
| xyseries tmp equip_no temp 
| fields - tmp</query>
    </search>
    <option name="drilldown">none</option>
    <option name="trellis.enabled">1</option>
    <option name="height">600</option>
    </single>
    </panel>
    </row>
    <row>
    <panel>
    <single id="chartPanel7">
    <search base="trellis">
    <query> 
| where filter &gt; 120 AND filter &lt; 141 
| eval tmp="T" 
| xyseries tmp equip_no temp 
| fields - tmp</query>
    </search>
    <option name="drilldown">none</option>
    <option name="trellis.enabled">1</option>
    <option name="height">600</option>
    </single>
    </panel>
    </row>
    <row>
    <panel>
    <single id="chartPanel8">
    <search base="trellis">
    <query> 
| where filter &gt; 140 AND filter &lt; 161 
| eval tmp="T" 
| xyseries tmp equip_no temp 
| fields - tmp</query>
    </search>
    <option name="drilldown">none</option>
    <option name="trellis.enabled">1</option>
    <option name="height">600</option>
    </single>
    </panel>
    </row>
    </form>

Hi, @pgadhari
I haven't tried it, but I made it.

0 Karma

pgadhari
Builder

@to4kawa - how do i accept this as an answer ? i dont see any options ?

0 Karma

woodcock
Esteemed Legend

You must be the Original Poster. If you are not, all you can do is UpVote it.

0 Karma

to4kawa
Ultra Champion

Thank you @woodcock and @pgadhari
Because I wrote it by force, it is amazing that you finished it beautifully.

0 Karma

pgadhari
Builder

Thanks. I have upvote the comments.

0 Karma

pgadhari
Builder

Sure. I will try this out and revert. Thanks 🙂

0 Karma

to4kawa
Ultra Champion
<dashboard>
  <label>trellis test</label>
  <search id="trellis">
    <query>| makeresults 
| eval host=mvzip(mvrange(1,128),mvrange(1,128)) 
| mvexpand host
| streamstats count as filter
| rex field=host mode=sed "s/\d+,/host_/g" 
| eval count = random() % 100 + 1
| append 
    [| makeresults 
    | eval _time=relative_time(_time,"+10m") 
    | eval host=mvzip(mvrange(1,128),mvrange(1,128)) 
| mvexpand host 
| streamstats count as filter
| rex field=host mode=sed "s/\d+,/host_/g" 
| eval count = random() % 100 + 1]
</query>
  </search>
  <row>
    <panel>
      <chart id="chartPanel1">
        <search base="trellis">
          <query>| where filter &gt; 0 AND filter &lt;21 
| eval host=if(filter&lt;10,upper(host),host)
| xyseries _time host count</query>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.placement">none</option>
        <option name="height">1000</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">1</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart id="chartPanel2">
        <search base="trellis">
          <query>| where filter &gt; 20 AND filter &lt;41 
| xyseries _time host count</query>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.placement">none</option>
        <option name="trellis.enabled">1</option>
        <option name="height">1000</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart id="chartPanel3">
        <search base="trellis">
          <query>| where filter &gt; 40 AND filter &lt;61 
| xyseries _time host count</query>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.placement">none</option>
        <option name="trellis.enabled">1</option>
        <option name="height">1000</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart id="chartPanel4">
        <search base="trellis">
          <query>| where filter &gt; 60 AND filter &lt;81 
| xyseries _time host count</query>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.placement">none</option>
        <option name="trellis.enabled">1</option>
        <option name="height">1000</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart id="chartPanel5">
        <search base="trellis">
          <query>| where filter &gt; 80 AND filter &lt;101 
| xyseries _time host count</query>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.placement">none</option>
        <option name="trellis.enabled">1</option>
        <option name="height">1000</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart id="chartPanel6">
        <search base="trellis">
          <query>| where filter &gt; 100 AND filter &lt;121 
| xyseries _time host count</query>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.placement">none</option>
        <option name="trellis.enabled">1</option>
        <option name="height">1000</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart id="chartPanel7">
        <search base="trellis">
          <query>| where filter &gt; 120 AND filter &lt;141 
| xyseries _time host count</query>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.placement">none</option>
        <option name="trellis.enabled">1</option>
        <option name="height">500</option>
      </chart>
    </panel>
  </row>
</dashboard>

Hi, @pgadhari
Created experimentally.
The display is appropriate to keep the lines as short as possible.
The display of 128 hosts is displayed.

pgadhari
Builder

alt text

But it shows only first 20 and others go into pagination.

0 Karma

niketn
Legend

@pgadhari while the Trellis limitation will not allow you to have more than 20 splits per page, based on the sample screenshot provided, seems like you need Single Value kind of viz with (1) Title (2) Value and (3) Viz background color. This you should be able to do with <html> panel where search results are parsed using Simple XML JS extension with Splunk JS to read search result and create html template. PS: Simple XML CSS Extension would be required for formatting viz background color as per range. Refer to one of my answers on similar lines. Kindly post a separate question specific to your needs if this does not help: https://answers.splunk.com/answers/662523/how-to-show-table-result-in-one-page-table-modific.html

PS: I dont know if Trellis configuration to show more than 20 splits per page would be available in the current dashboard framework since this has been a really old issue since 6.6 when Trellis was introduced. At the same time current Splunk Dashboard App (Beta) also does not have Trellis feature.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

pgadhari
Builder

Sure. Will try this out also and keep you posted.

0 Karma

pgadhari
Builder

@to4kawa - actually I want to show the temperature readings from 156 sensors in the form of image attached, but all these should be visible in single page, so that the monitoring team can identify any increase in temperatures for a particular sensor looking at that dashboard itself in a single view. Attached is the image for the reference. Actually, I am looking for a dashboard which looks like in ITSI Service Analyzer, which shows all boxes in a single pane.

0 Karma

pgadhari
Builder

My query :

index=test NOT failed NOT resource sourcetype=ups_temp | dedup object_id | eval temp=round(temp_value,2) | lookup ups_object_id object_id AS object_id OUTPUT equip_no | table temp equip_no | sort - temp | transpose 200 header_field=equip_no | fields - column
0 Karma

to4kawa
Ultra Champion

With simpleXML, there are 20 restrictions, so it would be unavoidable to attach the dashboard using base search and where
Individual queries are not so difficult

0 Karma

pgadhari
Builder

@to4kawa did not get it.. can you explain in more details how this can be achieved using base search ? You mean to say I have to use 156 individual searches to show each box ?

0 Karma

to4kawa
Ultra Champion

Can you provide a query?
I want to split the host into 20 and display it.

0 Karma

pgadhari
Builder

are you asking me solution for the trellis problem or do you need my query to check whether it can be done or not ?

0 Karma

to4kawa
Ultra Champion

Please check my answer.

0 Karma

woodcock
Esteemed Legend

There is now a JIRA on this ( SPL-176965 ) that also covers the fact that for trellis, we need a $click.name3$ for the BY field. if I have pie-charts trellissed BY host and I click on the pie-chart for host foo, I have no way to get the foo string to use for the drilldown, which is criminal. Supposedly all this will be fixed in the Dashboards (Beta) app first, when they roll trellis into it:
https://splunkbase.splunk.com/app/4710/

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...