Splunk Search

How to do trellis drilldown from the results ?

georgear7
Communicator

I have below query which will get results from other panels and corresponding results will get stored here. I have used global variable to get the results from other panels.

| makeresults
| eval AUGCB="$AUGCB-PROD$", AUCFS="$AUCFS-PROD$", AUVMA="$AUVMA-PROD$"
| stats values(AUGCB) as AUGCB, values(AUCFS) as AUCFS, values(AUVMA) as AUVMA

Currently my output showing as below after applying trellis. But i couldn't able to do trellis drilldown as my query doesn't have any Split by field. So requirement is how to make Split by field in my query for trellis drilldown. I tried to use both $trellis.value$ and $trellis.name$, but no luck.

georgear7_0-1603341921564.png

0 Karma
1 Solution

georgear7
Communicator

I could able to achieve trellis drilldown by using below query.

| makeresults
| eval _raw="Market Result
AUGCB $AUGCB-PROD$
AUCFS $AUCFS-PROD$
AUVMA $AUVMA-PROD$"
| multikv forceheader=1
| stats values(Result) as Result by Market

View solution in original post

0 Karma

georgear7
Communicator

I could able to achieve trellis drilldown by using below query.

| makeresults
| eval _raw="Market Result
AUGCB $AUGCB-PROD$
AUCFS $AUCFS-PROD$
AUVMA $AUVMA-PROD$"
| multikv forceheader=1
| stats values(Result) as Result by Market

0 Karma

georgear7
Communicator

@rnowitzki need your help here.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

    Are you ready to transform how your team handles complex data requests? We invite you to our upcoming ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...