https://community.splunk.com/t5/Splunk-Search/Sorting-Charts/m-p/45612#M10847 <P>Very nice.. I think I will use the addtotals option. Thanks!</P> Tue, 27 Nov 2012 16:31:05 GMT richnavis 2012-11-27T16:31:05Z https://community.splunk.com/t5/Splunk-Search/Sorting-Charts/m-p/45610#M10845 <P>I have the following search that returns a chart of response times for web pages by GET and POST. </P> <P>index=iis_PRODUCT | regex cs_method="(GET|POST)" | chart avg(time_taken) as response_time count(host) as hits by cs_uri_stem, cs_method | sort response_time</P> <P>However, the sort command does not seem to work. Perhaps it's because the field names have the method appended to it? something like this.... hits:GET hits:POST. Not sure how to solve this. </P> Mon, 28 Sep 2020 12:52:08 GMT https://community.splunk.com/t5/Splunk-Search/Sorting-Charts/m-p/45610#M10845 richnavis 2020-09-28T12:52:08Z https://community.splunk.com/t5/Splunk-Search/Sorting-Charts/m-p/45611#M10846 <P>You are indeed trying to sort by a column that does not exist at this time. I see two options:</P> <P>First, you could pick one of the columns to sort by. Let's assume one of the response_time fields is called "response_time: GET":</P> <PRE><CODE>search... | chart... | sort "response_time: GET" </CODE></PRE> <P>Alternatively, if you cannot decide which response time field is the relevant one to search, you could summarize them into a helper field that then is used for sorting:</P> <PRE><CODE>search... | chart... | addtotals fieldname=temp_sort response_time* | sort temp_sort </CODE></PRE> Mon, 28 Sep 2020 12:52:19 GMT https://community.splunk.com/t5/Splunk-Search/Sorting-Charts/m-p/45611#M10846 martin_mueller 2020-09-28T12:52:19Z https://community.splunk.com/t5/Splunk-Search/Sorting-Charts/m-p/45612#M10847 <P>Very nice.. I think I will use the addtotals option. Thanks!</P> Tue, 27 Nov 2012 16:31:05 GMT https://community.splunk.com/t5/Splunk-Search/Sorting-Charts/m-p/45612#M10847 richnavis 2012-11-27T16:31:05Z