Splunk Search

How to do trellis drilldown from the results ?

georgear7
Communicator

I have below query which will get results from other panels and corresponding results will get stored here. I have used global variable to get the results from other panels.

| makeresults
| eval AUGCB="$AUGCB-PROD$", AUCFS="$AUCFS-PROD$", AUVMA="$AUVMA-PROD$"
| stats values(AUGCB) as AUGCB, values(AUCFS) as AUCFS, values(AUVMA) as AUVMA

Currently my output showing as below after applying trellis. But i couldn't able to do trellis drilldown as my query doesn't have any Split by field. So requirement is how to make Split by field in my query for trellis drilldown. I tried to use both $trellis.value$ and $trellis.name$, but no luck.

georgear7_0-1603341921564.png

Labels (1)
0 Karma
1 Solution

georgear7
Communicator

I could able to achieve trellis drilldown by using below query.

| makeresults
| eval _raw="Market Result
AUGCB $AUGCB-PROD$
AUCFS $AUCFS-PROD$
AUVMA $AUVMA-PROD$"
| multikv forceheader=1
| stats values(Result) as Result by Market

View solution in original post

0 Karma

georgear7
Communicator

I could able to achieve trellis drilldown by using below query.

| makeresults
| eval _raw="Market Result
AUGCB $AUGCB-PROD$
AUCFS $AUCFS-PROD$
AUVMA $AUVMA-PROD$"
| multikv forceheader=1
| stats values(Result) as Result by Market

0 Karma

georgear7
Communicator

@rnowitzki need your help here.

0 Karma
Get Updates on the Splunk Community!

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...