topic Re: Splunk Chart dynamic column header sorting in Splunk Search

Splunk Chart dynamic column header sorting

avadhutha — Thu, 18 Jan 2024 15:08:37 GMT

I have a chart formed like below and it's dynamic columns are created based on processes date. By default now the column header sort is happing from lower to higher value but I am looking in a format where headers of processDates are higher to lower.

Query:

|chart latest(Count) as Count by Name ,ProcessDate

Current Output:

Name	20240101	20240102	20240103
xyz	NA	NA	NA
123	NA	NANA	NA

Expecting output:

Name	20240103	20240102	20240101
xyz	NA	NA	NA
123	NA	NANA	NA

Re: Splunk Chart dynamic column header sorting

dural_yyz — Thu, 18 Jan 2024 15:31:50 GMT

Try

| chart latest(Count) as Count by Name, ProcessDate
| sort ProcessDate desc

Found a very similar request under this previously answered question.

https://community.splunk.com/t5/Splunk-Search/How-to-display-column-results-in-descending-order/m-p/405619

Re: Splunk Chart dynamic column header sorting

avadhutha — Thu, 18 Jan 2024 15:39:37 GMT

No, it is not working

Re: Splunk Chart dynamic column header sorting

ITWhisperer — Thu, 18 Jan 2024 15:39:40 GMT

| transpose 0 column_name=Date header_field=Name | sort 0 -Date | transpose 0 column_name=Name header_field=Date

Re: Splunk Chart dynamic column header sorting

avadhutha — Thu, 18 Jan 2024 16:53:33 GMT

Thank you mate for the help, Below corrected one helped with faster results.

|chart latest(Count) as Count by ProcessDate,Name |sort 0 - ProcessDate | transpose 0 column_name=Name header_field=ProcDate