https://community.splunk.com/t5/Dashboards-Visualizations/Timechart-value-is-coming-same-even-after-Sorting/m-p/552824#M38315 <P>Hi Everyone,</P><P>I have two queries as shown below. For both I am doing sorting in different ways but stil there values are coming same.</P><P>index=abc source="/splunkLogs/JOB_MDJX_CS_STATS_PLATINUM.csv"|join type=outer JOBFLOW_ID [ inputlookup JOB_MDJX_CS_MASTER_E3.csv ]|eval fields=split(_raw,",")|eval Environment=mvindex(fields,11)|eval JOBFLOW_ID=mvindex(fields,0) |eval JOB_EXEC_TIME=mvindex(fields,8)|eval RunDate=mvindex(fields,3)|where Environment="E3"|where JOBFLOW_ID LIKE "%%"|eval RunDate="20".mvindex(fields,3)|fieldformat Run_Date=strftime(Run_Date,"%d/%b/%Y")|eval TotalExecTime=round(TotalExecTime,2)|timechart useother=f sum(JOB_EXEC_TIME) as TotalExecTime by JOBFLOW_ID |<STRONG>sort -TotalExecTime limit=10</STRONG></P><P>&nbsp;</P><P>&nbsp;</P><P>index=abc source="/splunkLogs/JOB_MDJX_CS_STATS_PLATINUM.csv"|join type=outer JOBFLOW_ID [ inputlookup JOB_MDJX_CS_MASTER_E3.csv ]|eval fields=split(_raw,",")|eval Environment=mvindex(fields,11)|eval JOBFLOW_ID=mvindex(fields,0) |eval JOB_EXEC_TIME=mvindex(fields,8)|eval RunDate=mvindex(fields,3)|where Environment="E3"|where JOBFLOW_ID LIKE "%%"|eval RunDate="20".mvindex(fields,3)|fieldformat Run_Date=strftime(Run_Date,"%d/%b/%Y")|eval TotalExecTime=round(TotalExecTime,2)|timechart useother=f sum(JOB_EXEC_TIME) as TotalExecTime by JOBFLOW_ID |<STRONG>sort TotalExecTime limit=10</STRONG></P><P><STRONG>Why there values are&nbsp;coming same can someone guide me.</STRONG></P><P><STRONG>Thanks in advance</STRONG></P><P>&nbsp;</P> Mon, 24 May 2021 18:54:48 GMT aditsss 2021-05-24T18:54:48Z https://community.splunk.com/t5/Dashboards-Visualizations/Timechart-value-is-coming-same-even-after-Sorting/m-p/552824#M38315 <P>Hi Everyone,</P><P>I have two queries as shown below. For both I am doing sorting in different ways but stil there values are coming same.</P><P>index=abc source="/splunkLogs/JOB_MDJX_CS_STATS_PLATINUM.csv"|join type=outer JOBFLOW_ID [ inputlookup JOB_MDJX_CS_MASTER_E3.csv ]|eval fields=split(_raw,",")|eval Environment=mvindex(fields,11)|eval JOBFLOW_ID=mvindex(fields,0) |eval JOB_EXEC_TIME=mvindex(fields,8)|eval RunDate=mvindex(fields,3)|where Environment="E3"|where JOBFLOW_ID LIKE "%%"|eval RunDate="20".mvindex(fields,3)|fieldformat Run_Date=strftime(Run_Date,"%d/%b/%Y")|eval TotalExecTime=round(TotalExecTime,2)|timechart useother=f sum(JOB_EXEC_TIME) as TotalExecTime by JOBFLOW_ID |<STRONG>sort -TotalExecTime limit=10</STRONG></P><P>&nbsp;</P><P>&nbsp;</P><P>index=abc source="/splunkLogs/JOB_MDJX_CS_STATS_PLATINUM.csv"|join type=outer JOBFLOW_ID [ inputlookup JOB_MDJX_CS_MASTER_E3.csv ]|eval fields=split(_raw,",")|eval Environment=mvindex(fields,11)|eval JOBFLOW_ID=mvindex(fields,0) |eval JOB_EXEC_TIME=mvindex(fields,8)|eval RunDate=mvindex(fields,3)|where Environment="E3"|where JOBFLOW_ID LIKE "%%"|eval RunDate="20".mvindex(fields,3)|fieldformat Run_Date=strftime(Run_Date,"%d/%b/%Y")|eval TotalExecTime=round(TotalExecTime,2)|timechart useother=f sum(JOB_EXEC_TIME) as TotalExecTime by JOBFLOW_ID |<STRONG>sort TotalExecTime limit=10</STRONG></P><P><STRONG>Why there values are&nbsp;coming same can someone guide me.</STRONG></P><P><STRONG>Thanks in advance</STRONG></P><P>&nbsp;</P> Mon, 24 May 2021 18:54:48 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Timechart-value-is-coming-same-even-after-Sorting/m-p/552824#M38315 aditsss 2021-05-24T18:54:48Z https://community.splunk.com/t5/Dashboards-Visualizations/Timechart-value-is-coming-same-even-after-Sorting/m-p/553321#M38388 <P>HI&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225066">@aditsss</a>,</P><P>because if you use the BY clause in a timechart or stats command, the name of the columns are the values of the field you used in the BY clause and not&nbsp;TotalExecTime&nbsp;so the sort command hasn't any effect.</P><P>Using timechart command you can sort only by the _time (when you have the BY clause).</P><P>Ciao.</P><P>Giuseppe</P> Thu, 27 May 2021 12:23:22 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Timechart-value-is-coming-same-even-after-Sorting/m-p/553321#M38388 gcusello 2021-05-27T12:23:22Z