Dashboards & Visualizations

trellis not working on columnchart when search is on lookup files

nareshinsvu
Builder

When I use index / datasource in my search query, I am getting preview as shown below

But when I use inputlookup csv file in my search, below is the preview. Couldn't display a trelli split layout? Should be a silly fix. But not able to do it after multiple trails.

alt text

I am looking for a working solution with lookup files. Below is my code.

<dashboard>
  <label></label>
  <description>Counts of Yesterday</description>
  <search id="mysearch">
    <!--    <query>|from datamodel: 0_Dataset|stats count by TRAN_CAT RESPONSE</query> -->
    <query> |inputlookup Stats_Yesterday.csv
</query>
    <sampleRatio>1</sampleRatio>
    <earliest>-1d@d</earliest>
    <latest>@d</latest>
  </search>
  <row depends="$alwaysHideCSSPanel$">
    <panel>
      <html>
         <style>
           .dashboard-panel h2{
             background:#177843 !important;
             color:black !important;
             text-align: center !important;
             font-weight: bold !important;
             border-top-right-radius: 15px;
             border-top-left-radius: 15px;
             }
           table thead{
             border: 1px solid blue;
  border-collapse: collapse;

    font-weight: bold;
             color:blue !important;
              text-align: left;
             }
         </style>
       </html>
    </panel>
  </row>
  <row>
    <panel>
      <table id="t1">
        <search base="mysearch"></search>
        <option name="count">50</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="TRAN_CAT">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="category"></scale>
        </format>
        <format type="color" field="RESPONSE">
          <colorPalette type="expression">if (like(value,"00_%"), "#65A637", "#f7ecc0")</colorPalette>
          <scale type="category"></scale>
        </format>
        <format type="color" field="count">
          <colorPalette type="minMidMax" maxColor="#e04c4c" midColor="#e0a94c" minColor="#65A637"></colorPalette>
          <scale type="minMidMax" maxType="percentile" maxValue="100" midType="percentile" midValue="50" minType="percentile" minValue="0"></scale>
        </format>
      </table>
    </panel>
    <panel>
      <chart>
        <search base="mysearch">
          <query>makemv delim="_" RESPONSE|eval RESPONSE=mvindex(RESPONSE, 0)</query>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">collapsed</option>
        <option name="charting.backgroundColor">#FEF9E7</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.legend.placement">none</option>
        <option name="height">600</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">small</option>
        <option name="trellis.splitBy">TRAN_CAT</option>
      </chart>
    </panel>
  </row>
</dashboard>
1 Solution

niketn
Legend

@nareshinsvu in your post-process search for Trellis chart you need to perform stats again to add split-by fields for Trellis

     <search base="mysearch">
       <query>makemv delim="_" RESPONSE|eval RESPONSE=mvindex(RESPONSE, 0)
                     | stats sum(count) as count by TRAN_CAT RESPOSE
        </query>
     </search>

Also, ideal use case for post-processing is not to pass on raw data from base search to post-process search. Base search should perform some stats (i.e. transforming command) and pass on the same to post-process search. Refer to Pos-Processing best practices: https://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Best_practices

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@nareshinsvu in your post-process search for Trellis chart you need to perform stats again to add split-by fields for Trellis

     <search base="mysearch">
       <query>makemv delim="_" RESPONSE|eval RESPONSE=mvindex(RESPONSE, 0)
                     | stats sum(count) as count by TRAN_CAT RESPOSE
        </query>
     </search>

Also, ideal use case for post-processing is not to pass on raw data from base search to post-process search. Base search should perform some stats (i.e. transforming command) and pass on the same to post-process search. Refer to Pos-Processing best practices: https://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Best_practices

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...