Dashboards & Visualizations
Highlighted

trellis not working on columnchart when search is on lookup files

Builder

When I use index / datasource in my search query, I am getting preview as shown below

But when I use inputlookup csv file in my search, below is the preview. Couldn't display a trelli split layout? Should be a silly fix. But not able to do it after multiple trails.

alt text

I am looking for a working solution with lookup files. Below is my code.

<dashboard>
  <label></label>
  <description>Counts of Yesterday</description>
  <search id="mysearch">
    <!--    <query>|from datamodel: 0_Dataset|stats count by TRAN_CAT RESPONSE</query> -->
    <query> |inputlookup Stats_Yesterday.csv
</query>
    <sampleRatio>1</sampleRatio>
    <earliest>-1d@d</earliest>
    <latest>@d</latest>
  </search>
  <row depends="$alwaysHideCSSPanel$">
    <panel>
      <html>
         <style>
           .dashboard-panel h2{
             background:#177843 !important;
             color:black !important;
             text-align: center !important;
             font-weight: bold !important;
             border-top-right-radius: 15px;
             border-top-left-radius: 15px;
             }
           table thead{
             border: 1px solid blue;
  border-collapse: collapse;

    font-weight: bold;
             color:blue !important;
              text-align: left;
             }
         </style>
       </html>
    </panel>
  </row>
  <row>
    <panel>
      <table id="t1">
        <search base="mysearch"></search>
        <option name="count">50</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="TRAN_CAT">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="category"></scale>
        </format>
        <format type="color" field="RESPONSE">
          <colorPalette type="expression">if (like(value,"00_%"), "#65A637", "#f7ecc0")</colorPalette>
          <scale type="category"></scale>
        </format>
        <format type="color" field="count">
          <colorPalette type="minMidMax" maxColor="#e04c4c" midColor="#e0a94c" minColor="#65A637"></colorPalette>
          <scale type="minMidMax" maxType="percentile" maxValue="100" midType="percentile" midValue="50" minType="percentile" minValue="0"></scale>
        </format>
      </table>
    </panel>
    <panel>
      <chart>
        <search base="mysearch">
          <query>makemv delim="_" RESPONSE|eval RESPONSE=mvindex(RESPONSE, 0)</query>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">collapsed</option>
        <option name="charting.backgroundColor">#FEF9E7</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.legend.placement">none</option>
        <option name="height">600</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">small</option>
        <option name="trellis.splitBy">TRAN_CAT</option>
      </chart>
    </panel>
  </row>
</dashboard>
Highlighted

Re: trellis not working on columnchart when search is on lookup files

Legend

@nareshinsvu in your post-process search for Trellis chart you need to perform stats again to add split-by fields for Trellis

     <search base="mysearch">
       <query>makemv delim="_" RESPONSE|eval RESPONSE=mvindex(RESPONSE, 0)
                     | stats sum(count) as count by TRAN_CAT RESPOSE
        </query>
     </search>

Also, ideal use case for post-processing is not to pass on raw data from base search to post-process search. Base search should perform some stats (i.e. transforming command) and pass on the same to post-process search. Refer to Pos-Processing best practices: https://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Best_practices

View solution in original post

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.