<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to Sort Fields by color using eval and chart? in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-sort-fields/m-p/594516#M48758</link>
    <description>&lt;LI-CODE lang="markup"&gt;| transpose 0 header_field=cat column_name=cat
| sort 0 - "row 1"
| transpose 0 header_field=cat column_name=cat
| fields - cat&lt;/LI-CODE&gt;</description>
    <pubDate>Wed, 20 Apr 2022 16:55:34 GMT</pubDate>
    <dc:creator>ITWhisperer</dc:creator>
    <dc:date>2022-04-20T16:55:34Z</dc:date>
    <item>
      <title>How to sort fields ?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-sort-fields/m-p/594496#M48755</link>
      <description>&lt;P&gt;I am currently using a bar chart visualization but I need to sort the bars by descending order.&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;I can't use a simple&amp;nbsp; &lt;FONT color="#0000FF"&gt;chart &lt;/FONT&gt;&lt;FONT color="#FF00FF"&gt;count&lt;/FONT&gt; &lt;FONT color="#FF6600"&gt;by&lt;/FONT&gt; EVNTSEVCAT | &lt;FONT color="#0000FF"&gt;sort&lt;/FONT&gt; -count&amp;nbsp; because the SEVCAT field contains multiple values and we only need I,II, and III.&lt;BR /&gt;&lt;BR /&gt;below is my query&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;search * 
| eval CATI = if(SEVCAT=="I", 1,0) 
| eval CATII = if(SEVCAT=="II", 1,0) 
| eval CATIII = if(SEVCAT=="III", 1,0) 
| chart sum(CATI) sum(CATII) sum(CATIII)
| transpose&lt;/LI-CODE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;The visualization:&lt;BR /&gt;&lt;BR /&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="sort.PNG" style="width: 999px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/19155iE3F9F6288D916058/image-size/large?v=v2&amp;amp;px=999" role="button" title="sort.PNG" alt="sort.PNG" /&gt;&lt;span class="lia-inline-image-caption" onclick="event.preventDefault();"&gt;sort.PNG&lt;/span&gt;&lt;/span&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;I need the visualization to be sorted in descending order. Any suggestions help :-).&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Thank you,&lt;/P&gt;
&lt;P&gt;Marco&lt;/P&gt;</description>
      <pubDate>Wed, 20 Apr 2022 16:44:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-sort-fields/m-p/594496#M48755</guid>
      <dc:creator>Marco_Develops</dc:creator>
      <dc:date>2022-04-20T16:44:49Z</dc:date>
    </item>
    <item>
      <title>Re: How to Sort Fields by color using eval and chart?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-sort-fields/m-p/594508#M48756</link>
      <description>&lt;P&gt;Do you mean sort the names in descending order or the values in descending order?&lt;/P&gt;</description>
      <pubDate>Wed, 20 Apr 2022 16:25:43 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-sort-fields/m-p/594508#M48756</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2022-04-20T16:25:43Z</dc:date>
    </item>
    <item>
      <title>Re: How to Sort Fields by color using eval and chart?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-sort-fields/m-p/594513#M48757</link>
      <description>&lt;P&gt;The values in descending order.&amp;nbsp;&lt;/P&gt;&lt;P&gt;The table below represents my bar chart:&amp;nbsp;&lt;/P&gt;&lt;TABLE border="1" width="100%"&gt;&lt;TBODY&gt;&lt;TR&gt;&lt;TD width="33.333333333333336%" height="25px"&gt;sum(CATI)&lt;/TD&gt;&lt;TD width="33.333333333333336%" height="25px"&gt;sum(CATII)&lt;/TD&gt;&lt;TD width="33.333333333333336%" height="25px"&gt;sum(CATIII)&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="33.333333333333336%" height="25px"&gt;7&lt;/TD&gt;&lt;TD width="33.333333333333336%" height="25px"&gt;141&lt;/TD&gt;&lt;TD width="33.333333333333336%" height="25px"&gt;3&lt;/TD&gt;&lt;/TR&gt;&lt;/TBODY&gt;&lt;/TABLE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;I want the bar chart to sort it out in descending order, so that way&lt;STRONG&gt;&amp;nbsp;sum(CATII)&amp;nbsp;&lt;/STRONG&gt;shows first, &lt;STRONG&gt;sum(CATI)&lt;/STRONG&gt; second, ,and &lt;STRONG&gt;sum(CATIII)&lt;/STRONG&gt; third&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;-Marco&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Wed, 20 Apr 2022 16:34:43 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-sort-fields/m-p/594513#M48757</guid>
      <dc:creator>Marco_Develops</dc:creator>
      <dc:date>2022-04-20T16:34:43Z</dc:date>
    </item>
    <item>
      <title>Re: How to Sort Fields by color using eval and chart?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-sort-fields/m-p/594516#M48758</link>
      <description>&lt;LI-CODE lang="markup"&gt;| transpose 0 header_field=cat column_name=cat
| sort 0 - "row 1"
| transpose 0 header_field=cat column_name=cat
| fields - cat&lt;/LI-CODE&gt;</description>
      <pubDate>Wed, 20 Apr 2022 16:55:34 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-sort-fields/m-p/594516#M48758</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2022-04-20T16:55:34Z</dc:date>
    </item>
    <item>
      <title>Re: How to Sort Fields by color using eval and chart?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-sort-fields/m-p/594525#M48759</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168"&gt;@ITWhisperer&lt;/a&gt;&amp;nbsp; Thank you I modified it a bit and it works. For people in the future, this is the final query, with the final visualization.&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;search * 
| eval CATI = if(SEVCAT=="I", 1,0) 
| eval CATII = if(SEVCAT=="II", 1,0) 
| eval CATIII = if(SEVCAT=="III", 1,0) 
| chart sum(CATI) sum(CATII) sum(CATIII)
| transpose
| sort - "row 1"&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="final.PNG" style="width: 999px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/19158i98D4927B066052D9/image-size/large?v=v2&amp;amp;px=999" role="button" title="final.PNG" alt="final.PNG" /&gt;&lt;span class="lia-inline-image-caption" onclick="event.preventDefault();"&gt;final.PNG&lt;/span&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;-Marco&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Wed, 20 Apr 2022 17:53:12 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-sort-fields/m-p/594525#M48759</guid>
      <dc:creator>Marco_Develops</dc:creator>
      <dc:date>2022-04-20T17:53:12Z</dc:date>
    </item>
  </channel>
</rss>

