When working with visualizations within Splunk one of the options presented is the ability to choose to use a trellis layout. A trellis layout for visualizations allows for you to split results from a search by fields so that each field value is visualized separately. This can be useful when needing to make differences within a common data set be more easily identifiable or to compare trends for a given field.
A trellis layout is also extremely useful for making dashboards faster by consolidating the number of searches on a dashboard that is required to produce multiple visualizations. Take, for example, a set of single value visualizations that illustrate the count of events for common error codes. Traditionally, a search ...
