Splunk's VisualizationTrellis documentation page shows example searches for things like count by sourcetype, and later shows trellis-ed visualizations for multi-value items, but there are no example searches for them. My data looks like this... { audit: { audit_enabled: Compliant, control_access: NotCompliant, firewall_on: NotCompliant, etc: ... } } I can create separate searches for each item in audit {} like this... source=device_audit | stats count by audit.audit_enabled But there are many audit items. I'd like to trellis pie charts for each audit item without creating a separate search for each. Is there are search I can use to trellis to produce three pie charts to show the split between compliant and notCompliant for each of the audit items (audit_enabled/control_access/firewall_on)? Thank you.
... View more
