Splunk Search

How do you create dummy values in a trellis chart?

tseale
New Member

I have locations 1-6, and I am needing them to stay in the same spot, even if in the time event, there is not a quantity value in the location.

index="data" 
| stats sum(Quantity) by Location

It is confusing on the floor when Location 6 is the 3rd tile instead of being on the end. I am needing to create placeholders that are blank for 1-6 that get updated as they start up.

0 Karma
1 Solution

niketn
Legend

@tseale try the following search and confirm. It creates 6 rows with Location 1, 2,3,4,5,6 and respective Quantity as 0. Then dedup is used to retain Location with Quantity from index search and missing Locations with Quantity as 0. I have applied a sort for statistical table but trellis should sort by default.

index="data" 
| stats sum(Quantity) as Quantity by Location
| append [| makeresults count=6
| fields - _time
| streamstats count as Location
| eval Quantity=0]
| dedup Location
| sort Location
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@tseale try the following search and confirm. It creates 6 rows with Location 1, 2,3,4,5,6 and respective Quantity as 0. Then dedup is used to retain Location with Quantity from index search and missing Locations with Quantity as 0. I have applied a sort for statistical table but trellis should sort by default.

index="data" 
| stats sum(Quantity) as Quantity by Location
| append [| makeresults count=6
| fields - _time
| streamstats count as Location
| eval Quantity=0]
| dedup Location
| sort Location
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

tseale
New Member

That worked, only change I had to make was |sort Location to get them in the right order.

Thank you so much!

0 Karma

tseale
New Member

alt text

0 Karma

tseale
New Member

I am wanting a box for 5 with the value blank or 0 in between box 4 and 6

0 Karma

niketn
Legend

@tseale what are the 6 location names? Are they static or dynamic? Can there be more than 6? Is there is master inventory configuration like lookup file, KV Store or Database table where all 6 locations (if required more) would be listed?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

tseale
New Member

There is always 6. The quantity is aggregated throughout the day. When we pull last 24 hours they rarely all have a quantity for that day. so the they are in different locations.

0 Karma

niketn
Legend

Sorry still a bit confusing. Could you elaborate with a mock up of what you have and what is the expected output?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...