https://community.splunk.com/t5/Splunk-Search/Can-t-get-my-chart-to-sort/m-p/483197#M135315 <P>That's the ticket! Thank you so much! Now I can look into the things I don't understand and learn from this!</P> Thu, 27 Feb 2020 13:22:49 GMT peterimbery 2020-02-27T13:22:49Z https://community.splunk.com/t5/Splunk-Search/Can-t-get-my-chart-to-sort/m-p/483195#M135313 <P>Here is my query</P> <P>index="myIndex" AND host="myHost" AND ObjectName="myObjectName" <BR /> | eval secondsEpoch = GroupDateTime/1000<BR /> | eval displayDate=strftime(secondsEpoch,"%m-%d %H:%M") <BR /> | chart sum(RecordCount) over CallingClass by displayDate<BR /> | sort 0 -GroupDateTime<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/8461i530A0C03600AB90B/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>GroupDateTime is a time that I am logging to splunk it contains an epoch time in milliseconds. </P> <P>No matter how I sort my data it comes out looking like this. What I want is the latest date on the left column. I have even tried to chart by CallingClass over GroupDateTime and that doesn't work either. I even tried _time. </P> <P>I have tried for several days to get this to work and can't find a solutions. I suspect it is probably something easy. <BR /> I am new to splunk so some solutions I didn't understand or couldn't get to work. </P> Wed, 26 Feb 2020 14:51:12 GMT https://community.splunk.com/t5/Splunk-Search/Can-t-get-my-chart-to-sort/m-p/483195#M135313 peterimbery 2020-02-26T14:51:12Z https://community.splunk.com/t5/Splunk-Search/Can-t-get-my-chart-to-sort/m-p/483196#M135314 <PRE><CODE>index="myIndex" AND host="myHost" AND ObjectName="myObjectName" | eval secondsEpoch = GroupDateTime/1000 | eval displayDate=strftime(secondsEpoch,"%m-%d %H:%M") |chart limit=0 useother=f usenull=f sum(RecordCount) as RecordCount by displayDate CallingClass |sort 0 - displayDate |transpose 0 header_field=displayDate column_name=CallingClass </CODE></PRE> Wed, 26 Feb 2020 21:20:42 GMT https://community.splunk.com/t5/Splunk-Search/Can-t-get-my-chart-to-sort/m-p/483196#M135314 to4kawa 2020-02-26T21:20:42Z https://community.splunk.com/t5/Splunk-Search/Can-t-get-my-chart-to-sort/m-p/483197#M135315 <P>That's the ticket! Thank you so much! Now I can look into the things I don't understand and learn from this!</P> Thu, 27 Feb 2020 13:22:49 GMT https://community.splunk.com/t5/Splunk-Search/Can-t-get-my-chart-to-sort/m-p/483197#M135315 peterimbery 2020-02-27T13:22:49Z