topic Re: How to change column order created by chart in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-change-column-order-created-by-chart/m-p/479993#M134542 <P>If you are searching for alphabetical, just add this to the bottom:</P> <PRE><CODE>... | table _* * </CODE></PRE> <P>If you need a particular order, then spell it out like thi| makeresults </P> <PRE><CODE>... | table _time P1 P2 P3 Etc and Whatever </CODE></PRE> Sat, 09 Nov 2019 22:00:30 GMT woodcock 2019-11-09T22:00:30Z How to change column order created by chart https://community.splunk.com/t5/Splunk-Search/How-to-change-column-order-created-by-chart/m-p/479991#M134540 <P>I create a search:</P> <P>...my search...<BR /> | chart values(duration) over TimeGap by Process</P> <P>The table shows duration used by each process at specific time gap (t1,t2,t3..). It looks like:</P> <P>TimeGap P3 P4 P1 P5 P2<BR /> t1<BR /> t2<BR /> t3<BR /> ...</P> <P>The column names (Pn) which are string-formatted field created by rex command mean different processes; they are sorted alphabetically with the chart command. How can I sort the Process by a specific sequence as P1 P2 P3 P4 P5?</P> Fri, 08 Nov 2019 11:09:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-change-column-order-created-by-chart/m-p/479991#M134540 halloweening 2019-11-08T11:09:50Z Re: How to change column order created by chart https://community.splunk.com/t5/Splunk-Search/How-to-change-column-order-created-by-chart/m-p/479992#M134541 <PRE><CODE>&lt;your query&gt;| fields P1,P2,P3,P4... </CODE></PRE> Fri, 08 Nov 2019 13:28:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-change-column-order-created-by-chart/m-p/479992#M134541 Sukisen1981 2019-11-08T13:28:24Z Re: How to change column order created by chart https://community.splunk.com/t5/Splunk-Search/How-to-change-column-order-created-by-chart/m-p/479993#M134542 <P>If you are searching for alphabetical, just add this to the bottom:</P> <PRE><CODE>... | table _* * </CODE></PRE> <P>If you need a particular order, then spell it out like thi| makeresults </P> <PRE><CODE>... | table _time P1 P2 P3 Etc and Whatever </CODE></PRE> Sat, 09 Nov 2019 22:00:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-change-column-order-created-by-chart/m-p/479993#M134542 woodcock 2019-11-09T22:00:30Z