How to Sort JSON Data by field value?

nkavouris — Fri, 24 Jan 2025 14:02:08 GMT

I have a base query which yield the field result, result can be either "Pass" or "Fail"

Sample query result is attached

How can I create a column chart with the count of passes and fails as different color columns?

here is my current search which yields a column chart with two columns of the same color

index="sampleindex" source="samplesource" | 
search test_name="IR Test" | 
search serial_number="TC-7"|
spath result | 
stats count by result

Re: How to Sort JSON Data by field value?

yuanliu — Sun, 26 Jan 2025 06:38:42 GMT

Splunk uses different colors for different numeric fields. Your stats command results in only one, count. There are many ways to make a field named Pass and another named Fail. As your output only contains a 2x2, the easiest is probably just transpose the output.

index="sampleindex" source="samplesource" test_name="IR Test" serial_number="TC-7" | stats count by result | transpose header_field=result

Additional tips:

Do not use screenshot to share text data. Share raw text.
Do not cascade filters that can be performed in initial index search.
Format Splunk searches with pipe sign at beginning of line, not end. You can enable "Search auto-format" in preferences to help you create readable searches.

topic Re: How to Sort JSON Data by field value? in Splunk Search

How to Sort JSON Data by field value?

Re: How to Sort JSON Data by field value?