topic Re: How to re-arrange a bar chart in Splunk Search

How to re-arrange a bar chart

jhoang — Mon, 01 Feb 2016 23:09:53 GMT

Hi,

I would like to sort my bar chart's by the following sequence, (Intensive, Intermediate, Minimal, Moderate). However it is currently being sorted alphabetically (Intensive, Intermediate, Minimal, Moderate.)

Below is my current search function:

index="sdp" Level !="Not Assigned" Urgency="*" | chart count over Level by Urgency | eval Level=if(Level="Intensive", "1. Intensive", if(Level="Intermediate","2. Intermediate", if(Level="Moderate","3. Moderate", if(Level="Minimal", "4. Minimal"

Re: How to re-arrange a bar chart

lguinn2 — Tue, 02 Feb 2016 02:40:02 GMT

Put the eval before the chart, like this

index="sdp" Level !="Not Assigned" Urgency="*" 
| eval Level=if(Level="Intensive", "1. Intensive", 
             if(Level="Intermediate","2. Intermediate", 
              if(Level="Moderate","3. Moderate",
            if(Level="Minimal", "4. Minimal"))))
| chart count by Level Urgency

Re: How to re-arrange a bar chart

chimell — Tue, 02 Feb 2016 10:13:20 GMT

Hi
try this search code

index="sdp" Level !="Not Assigned" Urgency="*" | chart count over Level by Urgency | eval Level=case(Level=="Intensive", "1. Intensive", Level=="Intermediate","2. Intermediate", Level=="Moderate","3. Moderate", Level=="Minimal", "4. Minimal")

Re: How to re-arrange a bar chart

jhoang — Tue, 02 Feb 2016 20:01:45 GMT

Hi Chimell,

The above query added the values to the different urgency (1,2,3,4) but it is still being arranged in :

1)intensive
2) intermediate
4) Minimal
3) moderate

Re: How to re-arrange a bar chart

jhoang — Tue, 02 Feb 2016 20:02:22 GMT

Hi Iguinn,

Another agent is helping me on this item, thank you.

Re: How to re-arrange a bar chart

jhoang — Wed, 03 Feb 2016 14:54:40 GMT

Hi Chimell,

Any update on this?

Re: How to re-arrange a bar chart

somesoni2 — Wed, 03 Feb 2016 15:58:03 GMT

I don't see any difference in your expected and current sort order. Do you expect Intensive, Intermediate, Moderate, Minimal as final sorting??? If yes, then @Iguinn's answer will give you correct sort order, after you update the expected sequence in that.

Re: How to re-arrange a bar chart

jhoang — Wed, 03 Feb 2016 16:28:51 GMT

Yea, that is correct, but when I ran Inguinn query, I received error message (Error in 'eval' command: The arguments to the 'if' function are invalid.)

Re: How to re-arrange a bar chart

somesoni2 — Wed, 03 Feb 2016 17:28:55 GMT

Here is same query with case instead of if.

index="sdp" Level !="Not Assigned" Urgency="*"  | eval Level=case(Level="Intensive", "1. Intensive", Level="Intermediate","2. Intermediate",Level="Moderate","3. Moderate", Level="Minimal", "4. Minimal", 1=1, "5. Not defined") | chart count by Level Urgency

Make sure the numbering is as per your need.

Re: How to re-arrange a bar chart

jhoang — Wed, 03 Feb 2016 17:56:13 GMT

it worked!!!! Thank you Somesoni2!!!