Dashboards & Visualizations

Trellis dynamic under label

manish_singh_77
Builder

Hi All,

Can we add dynamic multiple under label values as a token and show in the trellis single value?

 

Regards,

Manish 

Labels (1)
0 Karma
1 Solution

niketn
Legend

@manish_singh_77 , based on the details provided, although actual value of the tokens are dynamic, the number of tokens are static. If you want them as Under label it kind of implies that no. of single values in your Trellis layout is also statically fixed to 5 single values. So following are your options including the previous answers which is still applicable:

Option 1: Create separate panel with single value where Caption can be passed as tokens. As per details provided you will have 5 (static) splits of Single Value.

Option 2: Add tokens to SPL which powers the single value trellis. Once the values of tokens are resolved in the SPL, concatenate the value with the Trellis split by field using eval command. This will make the values from token appear as Trellis title which you can position as caption using Simple XML CSS override.

Option 3: Below the Trellis layout create a Row with 5 html panels and assign the tokens as div sections in those panels. Use CSS override to let the html panel stick underneath the Trellis panel and it will make them appear as caption for Single Value trellis.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@manish_singh_77  in past for similar use case, instead of using Under Label that can not be dynamic for Single Value Trellis, I had added the Under Label to the aggregation split by field. That would make the title for each of trellis layout viz. Then I would apply CSS override to move y-axis position by 150px-180px so that it would appear below the value in the viz as Under Label instead of title. I am unable to find the answer on communities, but hope you get the idea.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

manish_singh_77
Builder

@niketn 

Thanks for your reply. I would like to clarify few things here...

I want to pass multiple under labels as token which would be a dynamic value as per the query results. And these values should show underneath the trellis value.

For example

Application Name : $tok_appname$

Job Status: $tok_jobstatus$

Start Time: $tok_startime$

End Time: $tok_endtime$

Duration: $duration$

 

All these dynamic values show come inside the trellis value (single value panel box), let me know in case of any further queries.

 

 

0 Karma

niketn
Legend

@manish_singh_77 , based on the details provided, although actual value of the tokens are dynamic, the number of tokens are static. If you want them as Under label it kind of implies that no. of single values in your Trellis layout is also statically fixed to 5 single values. So following are your options including the previous answers which is still applicable:

Option 1: Create separate panel with single value where Caption can be passed as tokens. As per details provided you will have 5 (static) splits of Single Value.

Option 2: Add tokens to SPL which powers the single value trellis. Once the values of tokens are resolved in the SPL, concatenate the value with the Trellis split by field using eval command. This will make the values from token appear as Trellis title which you can position as caption using Simple XML CSS override.

Option 3: Below the Trellis layout create a Row with 5 html panels and assign the tokens as div sections in those panels. Use CSS override to let the html panel stick underneath the Trellis panel and it will make them appear as caption for Single Value trellis.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

manish_singh_77
Builder

Hi @niketn ,

 

Link provide you really worked well for my use case.

Here is a link that anyone else can refer if they have the same use case: https://community.splunk.com/t5/Dashboards-Visualizations/Issue-with-css-html-js-Formatting-Search-O...

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...