Hi, I'm trying to convert my classic dashboard to studio, and one of my bar charts is in trellis layout. For context this is my code: index | search tenant = "*" | dedup id, tenant | stats count ...
See more...
Hi, I'm trying to convert my classic dashboard to studio, and one of my bar charts is in trellis layout. For context this is my code: index | search tenant = "*" | dedup id, tenant | stats count as total_devices by tenant | join type=left [index | dedup id, tenant | where time > (now()-86400) | stats count as available_devices by tenant] | eval available_devices = if(isnull(available_devices) OR available_devices="", "0", available_devices) | eval unavailable_devices = total_devices - available_devices Ideally, the trellis layout will separate the results by tenant. However, when I use the splitSeries option, it separates into total_devices, available_devices, and unavailable_devices instead. Thanks! Any help will be appreciated.