Splunk Search

How do you use multiple by fields with a trellis layout?

tgdvopab
Path Finder

Hi all,

I want to get the average from a value, group this by cluster and hostname and show the value in a timechart.

With the grid-view, I would like to have one panel for each cluster.

For example:

index=foo sourcetype=bar | timechart avg(Value) by cluster,hostname

And have for each cluster a separate panel.

Is this possible? I know that multiple by fields are possible with the stats-command.

But, I'm not able to group them with the grid view.

Someone can help me please?

0 Karma

niketn
Legend

@tgdvopab, what do you imply by Grid View? If you are on Splunk 6.6 or higher, try to feed the output of following query to Trellis Layout and Split by Cluster as aggregation field.

 index=foo sourcetype=bar 
| bin _time span=1h
| stats count by  cluster,hostname
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

niketn
Legend

@tgdvopab if your issue is resolved, do go ahead and accept the answer to mark this question as resolved!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

tgdvopab
Path Finder

Thanks for your answer! 🙂
Now I need to have the data from stats in a timechart.
So I think I need also the _time value in stats, for example: stats count by _time,cluster,hostname
But this doesn't work. Do you have an idea?

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...