When I use index / datasource in my search query, I am getting preview as shown below
But when I use inputlookup csv file in my search, below is the preview. Couldn't display a trelli split layout? Should be a silly fix. But not able to do it after multiple trails.
I am looking for a working solution with lookup files. Below is my code.
<dashboard>
<label></label>
<description>Counts of Yesterday</description>
<search id="mysearch">
<!-- <query>|from datamodel: 0_Dataset|stats count by TRAN_CAT RESPONSE</query> -->
<query> |inputlookup Stats_Yesterday.csv
</query>
<sampleRatio>1</sampleRatio>
<earliest>-1d@d</earliest>
<latest>@d</latest>
</search>
<row depends="$alwaysHideCSSPanel$">
<panel>
<html>
<style>
.dashboard-panel h2{
background:#177843 !important;
color:black !important;
text-align: center !important;
font-weight: bold !important;
border-top-right-radius: 15px;
border-top-left-radius: 15px;
}
table thead{
border: 1px solid blue;
border-collapse: collapse;
font-weight: bold;
color:blue !important;
text-align: left;
}
</style>
</html>
</panel>
</row>
<row>
<panel>
<table id="t1">
<search base="mysearch"></search>
<option name="count">50</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="TRAN_CAT">
<colorPalette type="sharedList"></colorPalette>
<scale type="category"></scale>
</format>
<format type="color" field="RESPONSE">
<colorPalette type="expression">if (like(value,"00_%"), "#65A637", "#f7ecc0")</colorPalette>
<scale type="category"></scale>
</format>
<format type="color" field="count">
<colorPalette type="minMidMax" maxColor="#e04c4c" midColor="#e0a94c" minColor="#65A637"></colorPalette>
<scale type="minMidMax" maxType="percentile" maxValue="100" midType="percentile" midValue="50" minType="percentile" minValue="0"></scale>
</format>
</table>
</panel>
<panel>
<chart>
<search base="mysearch">
<query>makemv delim="_" RESPONSE|eval RESPONSE=mvindex(RESPONSE, 0)</query>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.axisTitleY2.visibility">collapsed</option>
<option name="charting.backgroundColor">#FEF9E7</option>
<option name="charting.chart">column</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.drilldown">all</option>
<option name="charting.legend.placement">none</option>
<option name="height">600</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">1</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">small</option>
<option name="trellis.splitBy">TRAN_CAT</option>
</chart>
</panel>
</row>
</dashboard>
@nareshinsvu in your post-process search for Trellis chart you need to perform stats again to add split-by fields for Trellis
<search base="mysearch">
<query>makemv delim="_" RESPONSE|eval RESPONSE=mvindex(RESPONSE, 0)
| stats sum(count) as count by TRAN_CAT RESPOSE
</query>
</search>
Also, ideal use case for post-processing is not to pass on raw data from base search to post-process search. Base search should perform some stats (i.e. transforming command) and pass on the same to post-process search. Refer to Pos-Processing best practices: https://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Best_practices
@nareshinsvu in your post-process search for Trellis chart you need to perform stats again to add split-by fields for Trellis
<search base="mysearch">
<query>makemv delim="_" RESPONSE|eval RESPONSE=mvindex(RESPONSE, 0)
| stats sum(count) as count by TRAN_CAT RESPOSE
</query>
</search>
Also, ideal use case for post-processing is not to pass on raw data from base search to post-process search. Base search should perform some stats (i.e. transforming command) and pass on the same to post-process search. Refer to Pos-Processing best practices: https://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Best_practices