Dashboards & Visualizations

trellis not working on columnchart when search is on lookup files

nareshinsvu
Builder

When I use index / datasource in my search query, I am getting preview as shown below

But when I use inputlookup csv file in my search, below is the preview. Couldn't display a trelli split layout? Should be a silly fix. But not able to do it after multiple trails.

alt text

I am looking for a working solution with lookup files. Below is my code.

<dashboard>
  <label></label>
  <description>Counts of Yesterday</description>
  <search id="mysearch">
    <!--    <query>|from datamodel: 0_Dataset|stats count by TRAN_CAT RESPONSE</query> -->
    <query> |inputlookup Stats_Yesterday.csv
</query>
    <sampleRatio>1</sampleRatio>
    <earliest>-1d@d</earliest>
    <latest>@d</latest>
  </search>
  <row depends="$alwaysHideCSSPanel$">
    <panel>
      <html>
         <style>
           .dashboard-panel h2{
             background:#177843 !important;
             color:black !important;
             text-align: center !important;
             font-weight: bold !important;
             border-top-right-radius: 15px;
             border-top-left-radius: 15px;
             }
           table thead{
             border: 1px solid blue;
  border-collapse: collapse;

    font-weight: bold;
             color:blue !important;
              text-align: left;
             }
         </style>
       </html>
    </panel>
  </row>
  <row>
    <panel>
      <table id="t1">
        <search base="mysearch"></search>
        <option name="count">50</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="TRAN_CAT">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="category"></scale>
        </format>
        <format type="color" field="RESPONSE">
          <colorPalette type="expression">if (like(value,"00_%"), "#65A637", "#f7ecc0")</colorPalette>
          <scale type="category"></scale>
        </format>
        <format type="color" field="count">
          <colorPalette type="minMidMax" maxColor="#e04c4c" midColor="#e0a94c" minColor="#65A637"></colorPalette>
          <scale type="minMidMax" maxType="percentile" maxValue="100" midType="percentile" midValue="50" minType="percentile" minValue="0"></scale>
        </format>
      </table>
    </panel>
    <panel>
      <chart>
        <search base="mysearch">
          <query>makemv delim="_" RESPONSE|eval RESPONSE=mvindex(RESPONSE, 0)</query>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">collapsed</option>
        <option name="charting.backgroundColor">#FEF9E7</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.legend.placement">none</option>
        <option name="height">600</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">small</option>
        <option name="trellis.splitBy">TRAN_CAT</option>
      </chart>
    </panel>
  </row>
</dashboard>
1 Solution

niketn
Legend

@nareshinsvu in your post-process search for Trellis chart you need to perform stats again to add split-by fields for Trellis

     <search base="mysearch">
       <query>makemv delim="_" RESPONSE|eval RESPONSE=mvindex(RESPONSE, 0)
                     | stats sum(count) as count by TRAN_CAT RESPOSE
        </query>
     </search>

Also, ideal use case for post-processing is not to pass on raw data from base search to post-process search. Base search should perform some stats (i.e. transforming command) and pass on the same to post-process search. Refer to Pos-Processing best practices: https://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Best_practices

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@nareshinsvu in your post-process search for Trellis chart you need to perform stats again to add split-by fields for Trellis

     <search base="mysearch">
       <query>makemv delim="_" RESPONSE|eval RESPONSE=mvindex(RESPONSE, 0)
                     | stats sum(count) as count by TRAN_CAT RESPOSE
        </query>
     </search>

Also, ideal use case for post-processing is not to pass on raw data from base search to post-process search. Base search should perform some stats (i.e. transforming command) and pass on the same to post-process search. Refer to Pos-Processing best practices: https://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Best_practices

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...