How to group values on the Flat\Untable multiple columns to get Trellis to work?

[kuzkuz]

Hello, either I'm missing something or this is impossible, I have a table like this:

Type,Model,Vendor,Total
A,100C,IBM,100
A,200C,Apple,50
B,25D,Apple,25
C,100C,Amazon,5

I would like the new Trellis visualization to provide a sum based on each column values, basically, this would save me creating lots of panels in dashboards.

In a nutshell it's like running stats for each column:

index=x|stats sum by Total, Model

I was trying to do the following:
Unpivot\Untable all values of columns into 1 column, keep Total as a second column.

The result should look like:

MyAttrib,Value,Total
--------------------------------
Type,A, 100
Model,100C, 100
Vendor,IBM, 100
Type,A, 50
Model,200C, 50
Vendor,Apple, 50

I tested the values in a formatted table like this, and Trellis make it look awesome.

How cool would it be to have a command like this to group values on dynamic columns on any given table? 🙂

Is that possible?

[kuzkuz · Accepted solution]

Might as well answer my own question.

The solution was simple, just using Untable with the "Total" field as the first argument (or use any other filed with Count)

index=mydata|untable Count,Column,Value|stats sum(total) by Column,Value

Look at all the pretty pie charts!

Sample search on forwarders data:

index=_internal source=*metrics.log|table *|untable index,column,value|stats count(index) by column,value