Dashboards & Visualizations

trellis usage

alon7786
New Member

Hi,

I'm trying to apply trellis visualization on the next query:

index=_internal type=Usage earliest=-14d latest=now
| eval MB=b/1024
| timechart sum(MB) span=1d by st
| timewrap 1week

the goal is to see all sourcetypes usage dynamically (current day usage vs same day on previous week usage).

Any help will be appreciated.

0 Karma

kmaron
Motivator

You should be able to just click the Trellis option, check the box for Use trellis layout and then select sourcetype as your Split By. Is this not working?

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...