I have 30 hosts. I would like to see a chart of all 30 hosts using the trellis layout but only 20 (2 rows of 10 each) are displayed at a time. I know I can use the "Next" link to see the remaining 10 charts but I want to see all 30 at once so I can put it on a operations monitor.
Is there a way to display more than 20 charts using trellis layout?
The documentation makes no mention of any limits.
Limitations
Fields generated with the eval command appear as aggregations in the trellis layout configuration menu.
Trellis layout is not available for table visualizations or cluster maps.
A predefined token is not available for aggregations used for splitting a visualization.
Visualizations using trellis layout do not render in dashboard PDFs.
tag cloud will not be useful, as I have to show both sensor name (ups name) as well as its temperature. I have created a dashboard with custom CSS showing all single value panels using your method of applying filter and showing in separate panels. I am awaiting reply from User for finalizing the look and feel. Attached is the sample dashboard image I have created.
I see, it would be hard to see about 150 displays.
Sweet, that looks really nice @rob_jordan, I think such a thing would be very useful in certain cases!
<form>
<label>ups temp</label>
<search id="trellis">
<query> index=test NOT failed NOT resource sourcetype=ups_temp
| dedup object_id
| eval temp=round(temp_value,2)
| lookup ups_object_id object_id AS object_id OUTPUT equip_no
| table temp equip_no
| sort - temp
| streamstats count as filter
</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<fieldset submitButton="false">
<input type="time" token="field1">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<single id="chartPanel1">
<search base="trellis">
<query>
| where filter > 0 AND filter < 21
| eval tmp="T"
| xyseries tmp equip_no temp
| fields - tmp</query>
</search>
<option name="drilldown">none</option>
<option name="trellis.enabled">1</option>
<option name="height">600</option>
</single>
</panel>
</row>
<row>
<panel>
<single id="chartPanel2">
<search base="trellis">
<query>
| where filter > 20 AND filter < 41
| eval tmp="T"
| xyseries tmp equip_no temp
| fields - tmp</query>
</search>
<option name="drilldown">none</option>
<option name="trellis.enabled">1</option>
<option name="height">600</option>
</single>
</panel>
</row>
<row>
<panel>
<single id="chartPanel3">
<search base="trellis">
<query>
| where filter > 40 AND filter < 61
| eval tmp="T"
| xyseries tmp equip_no temp
| fields - tmp</query>
</search>
<option name="drilldown">none</option>
<option name="trellis.enabled">1</option>
<option name="height">600</option>
</single>
</panel>
</row>
<row>
<panel>
<single id="chartPanel4">
<search base="trellis">
<query>
| where filter > 60 AND filter < 81
| eval tmp="T"
| xyseries tmp equip_no temp
| fields - tmp</query>
</search>
<option name="drilldown">none</option>
<option name="trellis.enabled">1</option>
<option name="height">600</option>
</single>
</panel>
</row>
<row>
<panel>
<single id="chartPanel5">
<search base="trellis">
<query>
| where filter > 80 AND filter < 101
| eval tmp="T"
| xyseries tmp equip_no temp
| fields - tmp</query>
</search>
<option name="drilldown">none</option>
<option name="trellis.enabled">1</option>
<option name="height">600</option>
</single>
</panel>
</row>
<row>
<panel>
<single id="chartPanel6">
<search base="trellis">
<query>
| where filter > 100 AND filter < 121
| eval tmp="T"
| xyseries tmp equip_no temp
| fields - tmp</query>
</search>
<option name="drilldown">none</option>
<option name="trellis.enabled">1</option>
<option name="height">600</option>
</single>
</panel>
</row>
<row>
<panel>
<single id="chartPanel7">
<search base="trellis">
<query>
| where filter > 120 AND filter < 141
| eval tmp="T"
| xyseries tmp equip_no temp
| fields - tmp</query>
</search>
<option name="drilldown">none</option>
<option name="trellis.enabled">1</option>
<option name="height">600</option>
</single>
</panel>
</row>
<row>
<panel>
<single id="chartPanel8">
<search base="trellis">
<query>
| where filter > 140 AND filter < 161
| eval tmp="T"
| xyseries tmp equip_no temp
| fields - tmp</query>
</search>
<option name="drilldown">none</option>
<option name="trellis.enabled">1</option>
<option name="height">600</option>
</single>
</panel>
</row>
</form>
Hi, @pgadhari
I haven't tried it, but I made it.
@to4kawa - how do i accept this as an answer ? i dont see any options ?
You must be the Original Poster. If you are not, all you can do is UpVote
it.
Thank you @woodcock and @pgadhari
Because I wrote it by force, it is amazing that you finished it beautifully.
Thanks. I have upvote the comments.
Sure. I will try this out and revert. Thanks 🙂
<dashboard>
<label>trellis test</label>
<search id="trellis">
<query>| makeresults
| eval host=mvzip(mvrange(1,128),mvrange(1,128))
| mvexpand host
| streamstats count as filter
| rex field=host mode=sed "s/\d+,/host_/g"
| eval count = random() % 100 + 1
| append
[| makeresults
| eval _time=relative_time(_time,"+10m")
| eval host=mvzip(mvrange(1,128),mvrange(1,128))
| mvexpand host
| streamstats count as filter
| rex field=host mode=sed "s/\d+,/host_/g"
| eval count = random() % 100 + 1]
</query>
</search>
<row>
<panel>
<chart id="chartPanel1">
<search base="trellis">
<query>| where filter > 0 AND filter <21
| eval host=if(filter<10,upper(host),host)
| xyseries _time host count</query>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.placement">none</option>
<option name="height">1000</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">1</option>
</chart>
</panel>
</row>
<row>
<panel>
<chart id="chartPanel2">
<search base="trellis">
<query>| where filter > 20 AND filter <41
| xyseries _time host count</query>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.placement">none</option>
<option name="trellis.enabled">1</option>
<option name="height">1000</option>
</chart>
</panel>
</row>
<row>
<panel>
<chart id="chartPanel3">
<search base="trellis">
<query>| where filter > 40 AND filter <61
| xyseries _time host count</query>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.placement">none</option>
<option name="trellis.enabled">1</option>
<option name="height">1000</option>
</chart>
</panel>
</row>
<row>
<panel>
<chart id="chartPanel4">
<search base="trellis">
<query>| where filter > 60 AND filter <81
| xyseries _time host count</query>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.placement">none</option>
<option name="trellis.enabled">1</option>
<option name="height">1000</option>
</chart>
</panel>
</row>
<row>
<panel>
<chart id="chartPanel5">
<search base="trellis">
<query>| where filter > 80 AND filter <101
| xyseries _time host count</query>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.placement">none</option>
<option name="trellis.enabled">1</option>
<option name="height">1000</option>
</chart>
</panel>
</row>
<row>
<panel>
<chart id="chartPanel6">
<search base="trellis">
<query>| where filter > 100 AND filter <121
| xyseries _time host count</query>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.placement">none</option>
<option name="trellis.enabled">1</option>
<option name="height">1000</option>
</chart>
</panel>
</row>
<row>
<panel>
<chart id="chartPanel7">
<search base="trellis">
<query>| where filter > 120 AND filter <141
| xyseries _time host count</query>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.placement">none</option>
<option name="trellis.enabled">1</option>
<option name="height">500</option>
</chart>
</panel>
</row>
</dashboard>
Hi, @pgadhari
Created experimentally.
The display is appropriate to keep the lines as short as possible.
The display of 128 hosts is displayed.
@pgadhari while the Trellis limitation will not allow you to have more than 20 splits per page, based on the sample screenshot provided, seems like you need Single Value kind of viz with (1) Title (2) Value and (3) Viz background color. This you should be able to do with <html>
panel where search results are parsed using Simple XML JS extension with Splunk JS to read search result and create html template. PS: Simple XML CSS Extension would be required for formatting viz background color as per range. Refer to one of my answers on similar lines. Kindly post a separate question specific to your needs if this does not help: https://answers.splunk.com/answers/662523/how-to-show-table-result-in-one-page-table-modific.html
PS: I dont know if Trellis configuration to show more than 20 splits per page would be available in the current dashboard framework since this has been a really old issue since 6.6 when Trellis was introduced. At the same time current Splunk Dashboard App (Beta) also does not have Trellis feature.
Sure. Will try this out also and keep you posted.
@to4kawa - actually I want to show the temperature readings from 156 sensors in the form of image attached, but all these should be visible in single page, so that the monitoring team can identify any increase in temperatures for a particular sensor looking at that dashboard itself in a single view. Attached is the image for the reference. Actually, I am looking for a dashboard which looks like in ITSI Service Analyzer, which shows all boxes in a single pane.
My query :
index=test NOT failed NOT resource sourcetype=ups_temp | dedup object_id | eval temp=round(temp_value,2) | lookup ups_object_id object_id AS object_id OUTPUT equip_no | table temp equip_no | sort - temp | transpose 200 header_field=equip_no | fields - column
With simpleXML, there are 20 restrictions, so it would be unavoidable to attach the dashboard using base search and where
Individual queries are not so difficult
@to4kawa did not get it.. can you explain in more details how this can be achieved using base search ? You mean to say I have to use 156 individual searches to show each box ?
Can you provide a query?
I want to split the host into 20 and display it.
are you asking me solution for the trellis problem or do you need my query to check whether it can be done or not ?
Please check my answer.
There is now a JIRA on this ( SPL-176965
) that also covers the fact that for trellis
, we need a $click.name3$
for the BY
field. if I have pie-charts trellissed BY host
and I click on the pie-chart for host foo
, I have no way to get the foo
string to use for the drilldown
, which is criminal. Supposedly all this will be fixed in the Dashboards (Beta)
app first, when they roll trellis
into it:
https://splunkbase.splunk.com/app/4710/