I'm trying to apply trellis visualization on the next query:
index=_internal type=Usage earliest=-14d latest=now
| eval MB=b/1024
| timechart sum(MB) span=1d by st
| timewrap 1week
the goal is to see all sourcetypes usage dynamically (current day usage vs same day on previous week usage).
Any help will be appreciated.
You should be able to just click the Trellis option, check the box for Use trellis layout and then select sourcetype as your Split By. Is this not working?