topic Re: sort bars in a chart so that Yesterday's bar is on the left of Today's bar for each value of "over" field in Dashboards & Visualizations

sort bars in a chart so that Yesterday's bar is on the left of Today's bar for each value of "over" field

nickrally2009 — Mon, 16 Mar 2020 18:31:15 GMT

I have this search, and it works correctly:

 source=foo resource=bar earliest=-1d@d latest=now
 | eval Day=if(_time<relative_time(now(),"@d"),"Yesterday","Today")
 | rex max_match=0 "(?:'id': )(?P<id>[^,]+)|(?:'usage': )(?P<usage>[^,]+)"
 | chart max(usage) over id by Day | where Yesterday!=Today | sort Today

It shows Today's bar on the left of Yesterday's bar for each id. I tried to reverse the order, to show Yesterday's bar on the left of Today's bar for each id, but did not find a way to make it work unless I rename the column(s), e.g. rename "Yesterday" to "Before" and rename "Today" to "Now". It appears that the default behavior is to sort in alphabetical order. Is there a better way to do this?
Thank you

Re: sort bars in a chart so that Yesterday's bar is on the left of Today's bar for each value of "over" field

niketn — Tue, 17 Mar 2020 05:18:13 GMT

Try the following.

   source=foo resource=bar earliest=-1d@d latest=now
  | eval Day=if(_time<relative_time(now(),"@d"),"1.Yesterday","2.Today")
  | rex max_match=0 "(?:'id': )(?P<id>[^,]+)|(?:'usage': )(?P<usage>[^,]+)"
  | chart max(usage) over id by Day 
  | where "1.Yesterday"!="2.Today"
  | rename "1.Yesterday" as "Yesterday" "2.Today" as Today

Re: sort bars in a chart so that Yesterday's bar is on the left of Today's bar for each value of "over" field

nickrally2009 — Tue, 17 Mar 2020 14:49:49 GMT

Thank you @niketnilay . I used Before and Now instead of Yesterday and Today respectively as an alternative to renaming, hoped there is a sort variation that could reverse the order instead of renaming.
There is also another way: | table, id, Yesterday, Today

Re: sort bars in a chart so that Yesterday's bar is on the left of Today's bar for each value of "over" field

woodcock — Tue, 17 Mar 2020 17:16:57 GMT

Add this:

... | rename Yesterday AS " Yesterday"

Adding the space will re-order the fields but be invisible.

Re: sort bars in a chart so that Yesterday's bar is on the left of Today's bar for each value of "over" field

nickrally2009 — Tue, 17 Mar 2020 19:26:23 GMT

Thank you, that's clever, will keep that in mind.
I accepted niketnilay's answer because it was first. In the end I did not use rename but used

| table, id, Yesterday, Today

Re: sort bars in a chart so that Yesterday's bar is on the left of Today's bar for each value of "over" field

woodcock — Tue, 17 Mar 2020 22:57:45 GMT

Curses, foiled again! Thanks for the UpVote! 😆