topic Re: _time column always moves to end after rendering search results in Splunk Search

_time column always moves to end after rendering search results

lancair — Thu, 15 Apr 2021 19:31:12 GMT

Desired Outcome : I am trying to create a simple timechart to show a count of ports and the relative time line on the x-axis. Sounds simple.

The problem: It appears timecharts (for whatever reason) use the first row of the results for the x-axis values.

Whenever I run a query, the _time columns is the first column shown while executing the query, but is always moved to the last column when the query is finished.

The result is the timechart uses whatever column value is sees in the first column as the x-values. If that' s by design, its rather awful as I see no way to hard code the x-axis values to another column.

I've tried a bunch of options to try and move the column back to the first column, but they all fail.

Here is one such option I tried. This of course does the same thing. Works great until the final results are rendered and then the _time column again moves to the end and fouls up the x-axis values. I've also tried renaming _time to a_ or 0_ to try to force the order, but no dice.

My search index blah blah..

| eval Date=strftime(_time,"%y-%m-%d %H:%M:%S") | timechart span=5m count by port useother=true limit=15 | table _time * | fields keepcolorder=t "_time" "*"

I've attached images "executing" and "execution complete" to show the difference.

Re: _time column always moves to end after rendering search results

maciep — Sat, 17 Apr 2021 11:50:55 GMT

does that happen if you just end the search after the timechart? did you add the table and fields commands to troubleshoot?

Re: _time column always moves to end after rendering search results

lancair — Thu, 06 May 2021 16:04:12 GMT

Yes, I the result is the same if the search is terminated as soon as the chart is rendered.

If I force the order using | table _time count etc and | untable _time count etc the order is persistent, but not conducive to creating the linechart with variable results from a single entity.

Re: _time column always moves to end after rendering search results

maciep — Fri, 07 May 2021 11:48:25 GMT

maybe a browser caching issue? have you tried other browsers? can you reproduce with any timechart search?

I would be surprised if it's a bug, because timechart is heavily used. But maybe check the release notes/known issues for your version of splunk?