Dashboards & Visualizations

trellis usage

alon7786
New Member

Hi,

I'm trying to apply trellis visualization on the next query:

index=_internal type=Usage earliest=-14d latest=now
| eval MB=b/1024
| timechart sum(MB) span=1d by st
| timewrap 1week

the goal is to see all sourcetypes usage dynamically (current day usage vs same day on previous week usage).

Any help will be appreciated.

0 Karma

kmaron
Motivator

You should be able to just click the Trellis option, check the box for Use trellis layout and then select sourcetype as your Split By. Is this not working?

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...