topic Re: Sort stacked bar chart columns based on a value in Splunk Search

Sort stacked bar chart columns based on a value

D_D — Sun, 27 Dec 2020 15:50:42 GMT

Hello,

I'm struggling with sorting bar chart columns based on a time value.

I have the following in my search:

| chart last(duration) as duration over run_id by task_id

and I get the following table:

run_id task_1 task_2 task_3 task_4 1 14.55000000 1.60000000 11.55000000 1.78333333 2 13.93333333 2.73333333 13.55000000 1.91666667

in the stacked chart visualization the tasks are showing from top to bottom in the order of the tasks column (first task_1 then task_2, etc).

i want to sort the task_id colums based on a value (start time) which i have on the initial search (pre charting) for each of the tasks.

is it possible to do that?

Thank you!

Re: Sort stacked bar chart columns based on a value

richgalloway — Sun, 27 Dec 2020 15:27:25 GMT

Try replacing the chart command with this

| eval _time = starttime | timechart last(duration) as duration by task_id

Re: Sort stacked bar chart columns based on a value

D_D — Sun, 27 Dec 2020 15:37:04 GMT

Hi,

appreciate your assistance,

when i change to your suggestion there is two issues:

1) The columns are still not sorted by starttime field.

2) The x-axis is now by time and not by task_id.

Re: Sort stacked bar chart columns based on a value

richgalloway — Sun, 27 Dec 2020 21:45:40 GMT

What x-axis? The original question had a table, not a graph, so why is there now a graph?

Let's start over. Please describe at length what data you have and what you would like the result of a query to look like. Explain any transformations necessary.

Re: Sort stacked bar chart columns based on a value

D_D — Mon, 28 Dec 2020 07:02:05 GMT

Hi,

Okay, so here is the raw data by fields:

run_id: task_name: starttime: finishtime:

I want to create a stack bar chart where in each bar i can see all the task_name fields for all run_id, and for each task_name i want to see his duration (calculated by finishtime-startime).

i achieved that by getting the following table and displaying in as a bar chart:

run_id task_1 task_2 task_3 task_4 1 14.55000000 1.60000000 11.55000000 1.78333333 2 13.93333333 2.73333333 13.55000000 1.91666667

on the current display, each bar contains 4 tasks by the order of them is (task_1 on the top, then task_2 bellow him and on the bottom there is task_4)

i want to rearrange that order by each task starttime (do task with the lowest start time should be at the bottom), so i believe i can do that by rearrange the columns.

But i still want the chart bar to be have x axis (run_in), y-axis(duration, using axis might be the wrong word, but i want duration over/by task_id for the chart display.