Splunk® Light

Getting Started Manual

Download manual as PDF

Download topic as PDF

Use trellis layout to split visualizations in Splunk Light

Trellis layout lets you split search results by fields or aggregations and visualize each field value separately.

This is a single value visualization with trellis layout applied. It splits customer purchase results by product category values. Users can see how the purchase metric varies for different product types.

Trellis layout example screenshot.png

Use cases

Use trellis layout to make value differences in a given data dimension more visible.

Highlight outlying values
Trellis layout can help to make outlying field values more noticeable. For example, your dashboard users might want to track status across multiple servers in a network. A single value visualization with trellis layout can show the status of multiple servers at once. Servers with unusual status values stand out.

Compare trends for a specific metric
You can split search results so that it is easier to compare different field values visually. For example, you can apply trellis layout to a bar chart showing recent customer activity for different product types. Splitting on the customer action field lets you scan variations in purchase frequency across different product types.

Monitor multiple resources with one search
Trellis layout can be helpful if you want to monitor multiple resources without creating and running multiple searches or generating multiple visualizations. You can use one search to generate metrics for each resource in a category or group and then split the visualization on the field that you are tracking.

Data formatting for trellis layout

Use trellis layout to split your search results on a field. You can also split the visualization on an aggregation if your search includes two or more aggregations, such as a count or sum.

Generating split fields
To use trellis layout, make sure that your search results include the field that you want to use for splitting the visualization. The split field is additional to any fields that you might need to generate the visualization without trellis layout. For example, you can generate a single value visualization using the following search.

index=_internal | stats count

To use trellis layout, adjust the search to generate an additional field for splitting the visualization.

index=_internal | stats count by sourcetype

You can split the single value on the sourcetype field to show a count for each sourcetype in your search results.

Use additional fields to add insight
Depending on your use case, you can generate multiple result fields to add further data dimensions to each visualization segment.

As an example, you can aggregate recent retail website data by customer action and product type. With these fields in your search results, you can use one of them to split the visualization. Users can use the split visualizations to compare customer actions across product types or see how product types relate to customer actions.

For more information on creating searches, see Statistical and charting functions in the Splunk Enterprise Search Reference.

Enable and configure trellis layout

Trellis layout lets you split on available result fields or aggregations. When enabling trellis layout, consider the comparisons or trends that you want to provide at a glance. Make sure that your search results include the fields or aggregations that represent these values.

Access the trellis menu from a visualization

If you are building a visualization on the Search page, you can access the Trellis configuration menu on the Visualization tab.

7.1 light trellis format.png

Trellis layout is not available for table visualizations or cluster maps.

Access the trellis menu from a dashboard

  1. From a dashboard, click Edit to open the dashboard editor.
  2. Find the panel where you want to apply trellis layout.
  3. Click the "More actions" icon and select Trellis.
    7.1 access trellis from dash.png

Configure trellis layout

When you enable trellis layout, you can use the "Split by" list to select a split field or aggregation.

Select a split field or aggregation
When you split the visualization by a field or aggregation, a separate visualization segment appears for each value in the selected field.

Result fields generated with the eval command appear in the aggregations list.

If you do not see the split field or aggregation that you want to use in this list, adjust the search to make sure that it generates the field in your search results. You might need to adjust your search to return additional fields that are not necessary for generating the visualization without trellis layout.


Adjust segment size
Select one of the segment size options. Segment size affects panel data density. Panels can show more small sized segments at once. Larger segments can help users make more detailed visual comparisons depending on the number of segments.

Small segments
7.1 trellis small.png

Large segments
7.1 trellis large.png

Formatting and appearance

Use the Format menu or Simple XML to configure visualization appearance. Format a visualization with trellis layout in the same way that you format a visualization without trellis layout. Each segment gets the format configurations that you apply.

Trellis layout and dashboard display

Segment density

The number of segments that trellis layout generates varies according to the number of split field or aggregation values in your search results. Dashboard panels might include a scroll bar if there are too many visualization segments to show at once.

7.1 trellis scroll.png

Use the Trellis menu to adjust the segment size and show more segments in the panel. You can also use the dashboard editor to drag the panel size or change the panel height option in Simple XML.

To change the order in which segments appear, adjust the search to sort or change search result order.

Panel and row best practice

Separate panels using trellis layout into their own dashboard rows. Displaying additional content in the same row can constrain trellis layout content and make the dashboard difficult to scan.

Avoid Best practice
Additional panels in the same row constrain display.

Trellis dashboard display best practice dont.png

Put the panel with trellis layout in its own row.

Trellis dashboard display best practice do.png

Drilldown in trellis layout

Use the drilldown editor or Simple XML to enable and configure drilldown. After you apply Trellis layout to a visualization, drilldown is available in each visualization segment.

Drilldown options

Typical drilldown actions, such as linking to a search or an external URL, are available for visualizations using Trellis layout. Depending on the behavior that you want, you can configure drilldown to capture and use details from the element and the visualization segment that a user clicks.

Example

This drilldown links to a search. By default, the secondary search modifies the original search to include field values from the clicked segment.

For example, trellis layout splits a retail activity visualization by customer action. if a user clicks the "ARCADE" category column in the "purchase" customer action segment, a secondary search using these field values opens.

Clicked visualization segment and column
7.1 clicked viz segment.png

Search generating the visualization

...| stats count by action, categoryId | rename categoryId as "category"

Drilldown search

...| action=purchase | rename categoryId as "category" | search category=ARCADE

Predefined tokens for trellis split fields

If your trellis layout splits on a search result field, you can use the trellis.name and trellis.value predefined tokens to access the split field name and value from a clicked visualization segment.

You can pass these values to a drilldown target, such as a form or external URL. This example drilldown links to an external retail website, using the trellis.value token to pass in the product field value from the clicked segment.

<drilldown>
<link>
  http://buttercupgames.com?product=$trellis.value$
</link>
</drilldown>

Aggregations are not available in predefined tokens.

Limitations

  • Fields generated with the eval command appear as aggregations in the trellis layout configuration menu.
  • Trellis layout is not available for table visualizations or cluster maps.
  • A predefined token is not available for aggregations used for splitting a visualization.
  • Visualizations using trellis layout do not render in dashboard PDFs.

Configure trellis layout in Simple XML

Use the following Simple XML options to configure trellis layout.

Property Type Description
trellis.enabled Boolean Enable or disable trellis layout. Defaults to false
trellis.size String Configure the visualization segment size. Segment size affects panel display density for the split visualization. Defaults to Medium.
trellis.splitBy Field name Indicate the field to use for splitting the visualization. Segments appear for each value in this field.

Example

Research sales trends

An analyst for an online retailer researches customer actions by product category. They use the following search to find recent customer action events by product category.

source=recent_sales_data action != NULL
| rename categoryId as "category"
|  chart count by category, action

The search generates the following column chart, showing customer actions across all product categories.

7.1 sales trends column.png


The analyst can use trellis layout to split the visualization into separate column charts for each customer action category. Trellis layout lets the analyst compare trends in the product types associated with each action.

7.1 trellis arcade drilldown.png

PREVIOUS
Use drilldown for dashboard interactivity in Splunk Light
  NEXT
Edit dashboards in Splunk Light

This documentation applies to the following versions of Splunk® Light: 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.3.0, 7.3.1, 7.3.2, 7.3.3


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters