Trellis Search

[JanetLong]

Splunk's VisualizationTrellis documentation page shows example searches for things like count by sourcetype, and later shows trellis-ed visualizations for multi-value items, but there are no example searches for them. 

My data looks like this...

{
   audit: {
     audit_enabled: Compliant,  
     control_access: NotCompliant,
     firewall_on: NotCompliant, 
     etc: ... 
   }
}

I can create separate searches for each item in audit {} like this...

source=device_audit 
| stats count by audit.audit_enabled

But there are many audit items. I'd like to trellis pie charts for each audit item without creating a separate search for each. 

Is there are search I can use to trellis to produce three pie charts to show the split between compliant and notCompliant for each of the audit items (audit_enabled/control_access/firewall_on)?

Thank you. 

[ITWhisperer · Accepted solution]

The part before the blank lines sets up some dummy data and should be replace with your search

| makeresults count=100
| eval _raw="{\"audit\":{\"audit_enabled\":\"".mvindex(split("Not|","|"),random()%2)."Compliant\",\"controlled_access\":\"".mvindex(split("Not|","|"),random()%2)."Compliant\",\"firewall_on\":\"".mvindex(split("Not|","|"),random()%2)."Compliant\"}}"


| spath
| fields - _raw
| untable _time audit state
| stats count by audit state

[JanetLong]

Brilliant. Thanks... I learned a lot from picking that apart.