Dashboards & Visualizations

trellis not working on columnchart when search is on lookup files

nareshinsvu
Builder

When I use index / datasource in my search query, I am getting preview as shown below

But when I use inputlookup csv file in my search, below is the preview. Couldn't display a trelli split layout? Should be a silly fix. But not able to do it after multiple trails.

alt text

I am looking for a working solution with lookup files. Below is my code.

<dashboard>
  <label></label>
  <description>Counts of Yesterday</description>
  <search id="mysearch">
    <!--    <query>|from datamodel: 0_Dataset|stats count by TRAN_CAT RESPONSE</query> -->
    <query> |inputlookup Stats_Yesterday.csv
</query>
    <sampleRatio>1</sampleRatio>
    <earliest>-1d@d</earliest>
    <latest>@d</latest>
  </search>
  <row depends="$alwaysHideCSSPanel$">
    <panel>
      <html>
         <style>
           .dashboard-panel h2{
             background:#177843 !important;
             color:black !important;
             text-align: center !important;
             font-weight: bold !important;
             border-top-right-radius: 15px;
             border-top-left-radius: 15px;
             }
           table thead{
             border: 1px solid blue;
  border-collapse: collapse;

    font-weight: bold;
             color:blue !important;
              text-align: left;
             }
         </style>
       </html>
    </panel>
  </row>
  <row>
    <panel>
      <table id="t1">
        <search base="mysearch"></search>
        <option name="count">50</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="TRAN_CAT">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="category"></scale>
        </format>
        <format type="color" field="RESPONSE">
          <colorPalette type="expression">if (like(value,"00_%"), "#65A637", "#f7ecc0")</colorPalette>
          <scale type="category"></scale>
        </format>
        <format type="color" field="count">
          <colorPalette type="minMidMax" maxColor="#e04c4c" midColor="#e0a94c" minColor="#65A637"></colorPalette>
          <scale type="minMidMax" maxType="percentile" maxValue="100" midType="percentile" midValue="50" minType="percentile" minValue="0"></scale>
        </format>
      </table>
    </panel>
    <panel>
      <chart>
        <search base="mysearch">
          <query>makemv delim="_" RESPONSE|eval RESPONSE=mvindex(RESPONSE, 0)</query>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">collapsed</option>
        <option name="charting.backgroundColor">#FEF9E7</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.legend.placement">none</option>
        <option name="height">600</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">small</option>
        <option name="trellis.splitBy">TRAN_CAT</option>
      </chart>
    </panel>
  </row>
</dashboard>
1 Solution

niketn
Legend

@nareshinsvu in your post-process search for Trellis chart you need to perform stats again to add split-by fields for Trellis

     <search base="mysearch">
       <query>makemv delim="_" RESPONSE|eval RESPONSE=mvindex(RESPONSE, 0)
                     | stats sum(count) as count by TRAN_CAT RESPOSE
        </query>
     </search>

Also, ideal use case for post-processing is not to pass on raw data from base search to post-process search. Base search should perform some stats (i.e. transforming command) and pass on the same to post-process search. Refer to Pos-Processing best practices: https://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Best_practices

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@nareshinsvu in your post-process search for Trellis chart you need to perform stats again to add split-by fields for Trellis

     <search base="mysearch">
       <query>makemv delim="_" RESPONSE|eval RESPONSE=mvindex(RESPONSE, 0)
                     | stats sum(count) as count by TRAN_CAT RESPOSE
        </query>
     </search>

Also, ideal use case for post-processing is not to pass on raw data from base search to post-process search. Base search should perform some stats (i.e. transforming command) and pass on the same to post-process search. Refer to Pos-Processing best practices: https://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Best_practices

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...