topic Re: Reverse Stacked Order of Column Chart in Dashboards & Visualizations

Reverse Stacked Order of Column Chart

itnewbie — Thu, 20 Jul 2023 08:49:12 GMT

Hi, I am new to Splunk. I have a stacked column chart after issuing this query:

(index="A" OR index="B") | chart count(Level) over _time span=1mon by Level usenull=f useother=f

where Level has four values: 1,2,3,4

The chart is like this:

As you can see the stack order is now 2 > 3 > 4 (from top to bottom), what if I want to reverse it to display like 4 > 3 > 2 (from top to bottom). I have seen similar questions here using transpose or reverse, I tried follow but still have no luck. Could anyone help?

Re: Reverse Stacked Order of Column Chart

ITWhisperer — Thu, 20 Jul 2023 09:05:48 GMT

The visualisation with put the bars in the order of the fields, first at the top.

Chart with order the fields in a sorted order, so in your case 1 will be first (and therefore top of the stack).

To rectify this, you could try this

| transpose 0 header_field=_time column_name=level | reverse | transpose 0 header_field=level column_name=_time

Re: Reverse Stacked Order of Column Chart

itnewbie — Thu, 20 Jul 2023 09:15:49 GMT

thanks for the reply. It worked. But what if I put it in chart overlay, like this:

(index="A" OR index="B") | eval Satisfaction = if(Satisfaction="good with comment", "good", Satisfaction) | eval Satisfaction = if(Satisfaction="bad with comment", "bad", Satisfaction) | chart count(Satisfaction) over _time span=1mon by Satisfaction usenull=f useother=f | appendcols [ | search (index="A" OR index="B") | chart count(Level) over _time span=1mon by Level usenull=f useother=f ]

where Level is from index A and Satisfaction is from index B. The chart like this:

I tried to wrap your suggestions in the appendcols cause this is column chart part where I want to reverse the order but it seemed won't work.

Re: Reverse Stacked Order of Column Chart

ITWhisperer — Thu, 20 Jul 2023 11:41:19 GMT

appendcols will sort the column names again.

Try it outside the appendcols

Re: Reverse Stacked Order of Column Chart

itnewbie — Fri, 21 Jul 2023 01:10:45 GMT

Thank you. It worked.