Display trellis based on rows

[Azwaliyana]

This serach result will always return 3 rows. I want display all row but in trellis. 

For the first row, it is the memory utilization for CIC-1

For the second row, it is the memory utilization for CIC-2

For the third row, it is the memory utilization for CIC-3

How can I do the trellis to display based on rows?

Do I need to add new column "Name" and insert CIC-1, CIC-2, CIC-3 to respective rows?

Azwaliyana_0-1640145638333.png

[isoutamo]

Hi 

You could do it like this:

| makeresults 
| eval _raw="Name count
CIC-1 59
CIC-2 63
CIC-3 53"
| multikv forceheader=1
``` previous spteps genereates sample data based on your example ```
| stats sum(count) as count by Name

Also table Name, count should be ok for your last step, but definitely you are needing key + value for trellis (https://docs.splunk.com/Documentation/Splunk/8.2.3/Viz/VisualizationTrellis)

Then select "Single value" for visualization and aggregate it by Name (not with count) when you are selecting Trellis.

isoutamo_0-1640163927089.png

r. Ismo