Dashboards & Visualizations

Trellis dynamic under label

manish_singh_77
Builder

Hi All,

Can we add dynamic multiple under label values as a token and show in the trellis single value?

 

Regards,

Manish 

Labels (1)
0 Karma
1 Solution

niketn
Legend

@manish_singh_77 , based on the details provided, although actual value of the tokens are dynamic, the number of tokens are static. If you want them as Under label it kind of implies that no. of single values in your Trellis layout is also statically fixed to 5 single values. So following are your options including the previous answers which is still applicable:

Option 1: Create separate panel with single value where Caption can be passed as tokens. As per details provided you will have 5 (static) splits of Single Value.

Option 2: Add tokens to SPL which powers the single value trellis. Once the values of tokens are resolved in the SPL, concatenate the value with the Trellis split by field using eval command. This will make the values from token appear as Trellis title which you can position as caption using Simple XML CSS override.

Option 3: Below the Trellis layout create a Row with 5 html panels and assign the tokens as div sections in those panels. Use CSS override to let the html panel stick underneath the Trellis panel and it will make them appear as caption for Single Value trellis.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@manish_singh_77  in past for similar use case, instead of using Under Label that can not be dynamic for Single Value Trellis, I had added the Under Label to the aggregation split by field. That would make the title for each of trellis layout viz. Then I would apply CSS override to move y-axis position by 150px-180px so that it would appear below the value in the viz as Under Label instead of title. I am unable to find the answer on communities, but hope you get the idea.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

manish_singh_77
Builder

@niketn 

Thanks for your reply. I would like to clarify few things here...

I want to pass multiple under labels as token which would be a dynamic value as per the query results. And these values should show underneath the trellis value.

For example

Application Name : $tok_appname$

Job Status: $tok_jobstatus$

Start Time: $tok_startime$

End Time: $tok_endtime$

Duration: $duration$

 

All these dynamic values show come inside the trellis value (single value panel box), let me know in case of any further queries.

 

 

0 Karma

niketn
Legend

@manish_singh_77 , based on the details provided, although actual value of the tokens are dynamic, the number of tokens are static. If you want them as Under label it kind of implies that no. of single values in your Trellis layout is also statically fixed to 5 single values. So following are your options including the previous answers which is still applicable:

Option 1: Create separate panel with single value where Caption can be passed as tokens. As per details provided you will have 5 (static) splits of Single Value.

Option 2: Add tokens to SPL which powers the single value trellis. Once the values of tokens are resolved in the SPL, concatenate the value with the Trellis split by field using eval command. This will make the values from token appear as Trellis title which you can position as caption using Simple XML CSS override.

Option 3: Below the Trellis layout create a Row with 5 html panels and assign the tokens as div sections in those panels. Use CSS override to let the html panel stick underneath the Trellis panel and it will make them appear as caption for Single Value trellis.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

manish_singh_77
Builder

Hi @niketn ,

 

Link provide you really worked well for my use case.

Here is a link that anyone else can refer if they have the same use case: https://community.splunk.com/t5/Dashboards-Visualizations/Issue-with-css-html-js-Formatting-Search-O...

0 Karma
Get Updates on the Splunk Community!

Get Inspired! We’ve Got Validation that Your Hard Work is Paying Off

We love our Splunk Community and want you to feel inspired by all your hard work! Eric Fusilero, our VP of ...

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...