Dashboards & Visualizations

Why does Trellis only return 10 plots when I need all plots to be displayed?

Lynyrd
Explorer

I finally got my splunk search to work but it only returns 10 of the 140 tests that are in the database. The trellis bell curve plots (bar chart) are arranged by test name but I only get 10 plots. What could possibly be wrong??

This works

sourcetype=mfgtestengsoftware  | search "Result Logged" "Results{}.Pass"=true "B1611" "CCS" | spath Results{}.Name | rename Results{}.Name AS StepName | spath Results{}.Actual  | rename Results{}.Actual AS Actual | eval Actual = Round(Actual) | transaction StepName, Actual | bin Actual span=10 | chart count over Actual by StepName useother=f

alt text

woodcock
Esteemed Legend

There is now a JIRA on this ( SPL-176965 ). Supposedly all this will be fixed in the Dashboards (Beta) app first, when they roll trellis into it:
https://splunkbase.splunk.com/app/4710/

0 Karma

DalJeanis
Legend

@Lynyrd - if your issue has been resolved, please accept that answer that solved it, so the question will show as closed. Thanks!

niketn
Legend

@Lynyrd, issue is not with Trellis, it is with chart command which returns only 10 results by default. Add limit=0

 <YourCurrentSearch>
| chart count over Actual by StepName limit=0 useother=f

PS: I feel your search query would need a lot of optimization. If you have query performance issues, do post it with code button 101010 on Splunk Answers so that special characters do not escape.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Lynyrd
Explorer

All of my plots have the same Y axis value, how can I adjust the X and Y axis dimensions so that each graphic is unique?

0 Karma

niketn
Legend

I think you are looking for Trellis Layout option to use Independent scale instead of Shared.

    <option name="trellis.scales.shared">0</option>

You can check out Trellis Layout related documentation on Splunk Docs: http://docs.splunk.com/Documentation/Splunk/latest/Viz/VisualizationTrellis

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@Lynyrd stumbled upon this old post. If your issue is resolved kindly accept the answer and up vote the answer/comment that helped.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Lynyrd
Explorer

Thank you. This appears to work nicely. I will move forward and if I get into any trouble I'll post another question. Thanks again for the help... PS I Bought a book "Exploring SPLUNK" Primer and Cook book and it does help but does not fully explain all aspects.

0 Karma

niketn
Legend

@Lynyrd, best place to start is Splunk Search Fundamentals 1 elearning course on Splunk Education. Complete Splunk Documentation online is available on docs.splunk.com and dev.splunk.com has walk-through and examples.

Following is a good place to refer to Splunk Search Optimization: http://docs.splunk.com/Documentation/Splunk/latest/Search/Quicktipsforoptimization

If your issue is resolved, please accept the answer and up vote comments that helped.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...