Splunk Search

How to do trellis drilldown from the results ?

georgear7
Communicator

I have below query which will get results from other panels and corresponding results will get stored here. I have used global variable to get the results from other panels.

| makeresults
| eval AUGCB="$AUGCB-PROD$", AUCFS="$AUCFS-PROD$", AUVMA="$AUVMA-PROD$"
| stats values(AUGCB) as AUGCB, values(AUCFS) as AUCFS, values(AUVMA) as AUVMA

Currently my output showing as below after applying trellis. But i couldn't able to do trellis drilldown as my query doesn't have any Split by field. So requirement is how to make Split by field in my query for trellis drilldown. I tried to use both $trellis.value$ and $trellis.name$, but no luck.

georgear7_0-1603341921564.png

0 Karma
1 Solution

georgear7
Communicator

I could able to achieve trellis drilldown by using below query.

| makeresults
| eval _raw="Market Result
AUGCB $AUGCB-PROD$
AUCFS $AUCFS-PROD$
AUVMA $AUVMA-PROD$"
| multikv forceheader=1
| stats values(Result) as Result by Market

View solution in original post

0 Karma

georgear7
Communicator

I could able to achieve trellis drilldown by using below query.

| makeresults
| eval _raw="Market Result
AUGCB $AUGCB-PROD$
AUCFS $AUCFS-PROD$
AUVMA $AUVMA-PROD$"
| multikv forceheader=1
| stats values(Result) as Result by Market

0 Karma

georgear7
Communicator

@rnowitzki need your help here.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...