Trellis layout

When working with visualizations within Splunk one of the options presented is the ability to choose to use a trellis layout. A trellis layout for visualizations allows for you to split results from a search by fields so that each field value is visualized separately. This can be useful when needing to make differences within a common data set be more easily identifiable or to compare trends for a given field.

A trellis layout is also extremely useful for making dashboards faster by consolidating the number of searches on a dashboard that is required to produce multiple visualizations. Take, for example, a set of single value visualizations that illustrate the count of events for common error codes. Traditionally, a search would be written for each single value panel to filter the count of the desired error code. However, when using a trellis layout a single search could be written that generates the count for each error code, and the trellis layout can be configured so that it will split the visualization into multiple visualizations by error code.

For more information on using a trellis layout, visit http://docs.splunk.com/Documentation/Splunk/latest/Viz/ VisualizationTrellis.