https://community.splunk.com/t5/Dashboards-Visualizations/addcoltotals-floats-the-label-column-to-the-right/m-p/58735#M3097 <P>Search:</P> <PRE><CODE>index=_internal source=*license_usage.log | eval ISODate=strftime(strptime(date_year."-".date_month."-".date_mday, "%Y-%b-%d"), "%Y-%m-%d (%a)") | eval MB=b/1024/1024 | chart eval(round(sum(MB),0)) over i by ISODate limit=0 | addcoltotals labelfield=i </CODE></PRE> <P>I'm not sure the ISODate evaluation is the best way to achieve my end, but that is not the issue here. The problem is that when I use this chart, the column with the indexer UIDs is floated to the rightmost position in the table (presumably due to the fact that a simple alphanumeric string sort puts the dates before the letter "i"). What I need is to anchor the indexer column to the left regardless.</P> Wed, 23 May 2012 19:14:18 GMT rijhwani 2012-05-23T19:14:18Z https://community.splunk.com/t5/Dashboards-Visualizations/addcoltotals-floats-the-label-column-to-the-right/m-p/58735#M3097 <P>Search:</P> <PRE><CODE>index=_internal source=*license_usage.log | eval ISODate=strftime(strptime(date_year."-".date_month."-".date_mday, "%Y-%b-%d"), "%Y-%m-%d (%a)") | eval MB=b/1024/1024 | chart eval(round(sum(MB),0)) over i by ISODate limit=0 | addcoltotals labelfield=i </CODE></PRE> <P>I'm not sure the ISODate evaluation is the best way to achieve my end, but that is not the issue here. The problem is that when I use this chart, the column with the indexer UIDs is floated to the rightmost position in the table (presumably due to the fact that a simple alphanumeric string sort puts the dates before the letter "i"). What I need is to anchor the indexer column to the left regardless.</P> Wed, 23 May 2012 19:14:18 GMT https://community.splunk.com/t5/Dashboards-Visualizations/addcoltotals-floats-the-label-column-to-the-right/m-p/58735#M3097 rijhwani 2012-05-23T19:14:18Z https://community.splunk.com/t5/Dashboards-Visualizations/addcoltotals-floats-the-label-column-to-the-right/m-p/58736#M3098 <P>OK, so it only floats right during the real time aggregation. On completion it floats back left.</P> <P>Odd behaviour, and not documented anywhere I could find.</P> Wed, 23 May 2012 19:16:41 GMT https://community.splunk.com/t5/Dashboards-Visualizations/addcoltotals-floats-the-label-column-to-the-right/m-p/58736#M3098 rijhwani 2012-05-23T19:16:41Z