https://community.splunk.com/t5/Splunk-Search/How-to-sort-values-on-x-axis-based-on-the-values-of-other-fields/m-p/415470#M119601 <P>@bollam </P> <P>You can try by retaining order in other field..</P> <P>Can you please try this?</P> <PRE><CODE>index=main | eventstats earliest(startTime) as start_time by job | stats first(totalMB) as total sum(UsedMB) AS a by start_time, job | eval pct=round((a/total)*100,2) | table job start_time pct | eval no=1 | accum no | chart avg(pct) as Mem_used values(no) as no by job | sort no | fields - no </CODE></PRE> Fri, 30 Nov 2018 08:58:46 GMT kamlesh_vaghela 2018-11-30T08:58:46Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-values-on-x-axis-based-on-the-values-of-other-fields/m-p/415469#M119600 <P>Hello,</P> <P>I'm trying to plot a graph based on three fields.</P> <P>The events contain the job, startTime, usedMemory. I want to plot a graph based on the start_time(epochTime) of the job.</P> <P>I have a query written as follow.</P> <PRE><CODE>index=main | eventstats earliest(startTime) as start_time by job | stats first(totalMB) as total sum(UsedMB) AS a by start_time, stage | eval pct=round((a/total)*100,2) | table start_time stage pct </CODE></PRE> <P>This query is giving me the right results as expected.</P> <P>job start_time pct<BR /> b 00:05 20<BR /> c 00:10 15<BR /> f 00:25 55<BR /> a 00:00 40<BR /> d 00:15 60</P> <P>When trying to plot a graph using following query, The job is getting sorted in the ascending order which I do not want.<BR /> I wanted the way how it is shown above on the x-axis ( b c f a d )</P> <P>I need the values on the x-axis how the results with table command.</P> <PRE><CODE>index=main | eventstats earliest(startTime) as start_time by job | stats first(totalMB) as total sum(UsedMB) AS a by start_time, job | eval pct=round((a/total)*100,2) | table start_time job pct | chart avg(pct) as Mem_used by job </CODE></PRE> Fri, 30 Nov 2018 08:43:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-values-on-x-axis-based-on-the-values-of-other-fields/m-p/415469#M119600 bollam 2018-11-30T08:43:57Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-values-on-x-axis-based-on-the-values-of-other-fields/m-p/415470#M119601 <P>@bollam </P> <P>You can try by retaining order in other field..</P> <P>Can you please try this?</P> <PRE><CODE>index=main | eventstats earliest(startTime) as start_time by job | stats first(totalMB) as total sum(UsedMB) AS a by start_time, job | eval pct=round((a/total)*100,2) | table job start_time pct | eval no=1 | accum no | chart avg(pct) as Mem_used values(no) as no by job | sort no | fields - no </CODE></PRE> Fri, 30 Nov 2018 08:58:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-values-on-x-axis-based-on-the-values-of-other-fields/m-p/415470#M119601 kamlesh_vaghela 2018-11-30T08:58:46Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-values-on-x-axis-based-on-the-values-of-other-fields/m-p/415471#M119602 <P>@kamlesh_vaghela, Thanks much!! It worked</P> Mon, 03 Dec 2018 06:41:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-values-on-x-axis-based-on-the-values-of-other-fields/m-p/415471#M119602 bollam 2018-12-03T06:41:13Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-values-on-x-axis-based-on-the-values-of-other-fields/m-p/415472#M119603 <P>@bollam</P> <P>Glad to help you. Can you please accept the answer to help the community.</P> <P><STRONG>Happy Splunking</STRONG></P> Mon, 03 Dec 2018 12:51:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-values-on-x-axis-based-on-the-values-of-other-fields/m-p/415472#M119603 kamlesh_vaghela 2018-12-03T12:51:33Z