Dashboards & Visualizations

trellis not working on columnchart when search is on lookup files

nareshinsvu
Builder

When I use index / datasource in my search query, I am getting preview as shown below

But when I use inputlookup csv file in my search, below is the preview. Couldn't display a trelli split layout? Should be a silly fix. But not able to do it after multiple trails.

alt text

I am looking for a working solution with lookup files. Below is my code.

<dashboard>
  <label></label>
  <description>Counts of Yesterday</description>
  <search id="mysearch">
    <!--    <query>|from datamodel: 0_Dataset|stats count by TRAN_CAT RESPONSE</query> -->
    <query> |inputlookup Stats_Yesterday.csv
</query>
    <sampleRatio>1</sampleRatio>
    <earliest>-1d@d</earliest>
    <latest>@d</latest>
  </search>
  <row depends="$alwaysHideCSSPanel$">
    <panel>
      <html>
         <style>
           .dashboard-panel h2{
             background:#177843 !important;
             color:black !important;
             text-align: center !important;
             font-weight: bold !important;
             border-top-right-radius: 15px;
             border-top-left-radius: 15px;
             }
           table thead{
             border: 1px solid blue;
  border-collapse: collapse;

    font-weight: bold;
             color:blue !important;
              text-align: left;
             }
         </style>
       </html>
    </panel>
  </row>
  <row>
    <panel>
      <table id="t1">
        <search base="mysearch"></search>
        <option name="count">50</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="TRAN_CAT">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="category"></scale>
        </format>
        <format type="color" field="RESPONSE">
          <colorPalette type="expression">if (like(value,"00_%"), "#65A637", "#f7ecc0")</colorPalette>
          <scale type="category"></scale>
        </format>
        <format type="color" field="count">
          <colorPalette type="minMidMax" maxColor="#e04c4c" midColor="#e0a94c" minColor="#65A637"></colorPalette>
          <scale type="minMidMax" maxType="percentile" maxValue="100" midType="percentile" midValue="50" minType="percentile" minValue="0"></scale>
        </format>
      </table>
    </panel>
    <panel>
      <chart>
        <search base="mysearch">
          <query>makemv delim="_" RESPONSE|eval RESPONSE=mvindex(RESPONSE, 0)</query>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">collapsed</option>
        <option name="charting.backgroundColor">#FEF9E7</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.legend.placement">none</option>
        <option name="height">600</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">small</option>
        <option name="trellis.splitBy">TRAN_CAT</option>
      </chart>
    </panel>
  </row>
</dashboard>
1 Solution

niketn
Legend

@nareshinsvu in your post-process search for Trellis chart you need to perform stats again to add split-by fields for Trellis

     <search base="mysearch">
       <query>makemv delim="_" RESPONSE|eval RESPONSE=mvindex(RESPONSE, 0)
                     | stats sum(count) as count by TRAN_CAT RESPOSE
        </query>
     </search>

Also, ideal use case for post-processing is not to pass on raw data from base search to post-process search. Base search should perform some stats (i.e. transforming command) and pass on the same to post-process search. Refer to Pos-Processing best practices: https://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Best_practices

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@nareshinsvu in your post-process search for Trellis chart you need to perform stats again to add split-by fields for Trellis

     <search base="mysearch">
       <query>makemv delim="_" RESPONSE|eval RESPONSE=mvindex(RESPONSE, 0)
                     | stats sum(count) as count by TRAN_CAT RESPOSE
        </query>
     </search>

Also, ideal use case for post-processing is not to pass on raw data from base search to post-process search. Base search should perform some stats (i.e. transforming command) and pass on the same to post-process search. Refer to Pos-Processing best practices: https://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Best_practices

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...