https://community.splunk.com/t5/Splunk-Search/How-to-specify-the-order-of-fields-legend-in-a-chart/m-p/101312#M26180 <P>If you are graphing something and your legend values are coming out: </P> <PRE><CODE>alert_120s alert_15s alert_180s alert_300s alert_600s alert_60s </CODE></PRE> <P>and you want the legend values to be in this order: </P> <PRE><CODE>alert_15s alert_60s alert_120s alert_180s alert_300s alert_600s </CODE></PRE> <P>it's dead simple. Take whatever search was generating the order you didnt want, and tack on a fields clause to reorder them. </P> <PRE><CODE>&lt;your search&gt; | fields _* * alert_15s alert_60s alert_120s alert_180s alert_300s alert_600s </CODE></PRE> <P>The FlashChart module just puts up legend items in the order it gets them, so all you have to do is change the order with <CODE>fields</CODE> or <CODE>table</CODE></P> <P>The little wildcard terms are telling splunk to put all the hidden 'underscore' columns first, then any other columns, and then finally end the sequence with the specified columns. If you'd rather specify the columns explicitly you can of course do that. Note that the fields clause seems to damage timechart now, in that the _time field can get removed if you leave off _* or _time... </P> Sun, 06 Mar 2011 05:04:55 GMT sideview 2011-03-06T05:04:55Z https://community.splunk.com/t5/Splunk-Search/How-to-specify-the-order-of-fields-legend-in-a-chart/m-p/101310#M26178 <P>I created a search query that returns a set of database alerts which contains a field called alert. The field contains text values such as alert_15s, alert_120s, etc</P> <P>I am building a stacked chart which currently display these alerts in this order:</P> <PRE><CODE>alert_120s alert_15s alert_180s alert_300s alert_600s alert_60s </CODE></PRE> <P>How can I change the order of the fields/legends to be this way:</P> <PRE><CODE>alert_15s alert_60s alert_120s alert_180s alert_300s alert_600s </CODE></PRE> <P>Thanks, Jean</P> Thu, 09 Dec 2010 00:30:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-specify-the-order-of-fields-legend-in-a-chart/m-p/101310#M26178 jdagenais 2010-12-09T00:30:41Z https://community.splunk.com/t5/Splunk-Search/How-to-specify-the-order-of-fields-legend-in-a-chart/m-p/101311#M26179 <P>This is the solution I have found for these type of problems. </P> <P>This provides both a tabular and sorted results by month, day, and alert types.</P> <PRE><CODE>* sourcetype="sybase_alert" NOT alert="alert_error" NOT alert="alert_network" | stats count(eval(alert="alert_15s")) as a_015, count(eval(alert="alert_60s")) as a_060, count(eval(alert="alert_120s")) as a_120, count(eval(alert="alert_300s")) as a_300, count(eval(alert="alert_600s")) as a_600, count(eval(alert="alert_deadlock")) as deadlock, by date_month, date_mday | sort date_month, date_mday </CODE></PRE> Sat, 11 Dec 2010 18:10:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-specify-the-order-of-fields-legend-in-a-chart/m-p/101311#M26179 jdagenais 2010-12-11T18:10:55Z https://community.splunk.com/t5/Splunk-Search/How-to-specify-the-order-of-fields-legend-in-a-chart/m-p/101312#M26180 <P>If you are graphing something and your legend values are coming out: </P> <PRE><CODE>alert_120s alert_15s alert_180s alert_300s alert_600s alert_60s </CODE></PRE> <P>and you want the legend values to be in this order: </P> <PRE><CODE>alert_15s alert_60s alert_120s alert_180s alert_300s alert_600s </CODE></PRE> <P>it's dead simple. Take whatever search was generating the order you didnt want, and tack on a fields clause to reorder them. </P> <PRE><CODE>&lt;your search&gt; | fields _* * alert_15s alert_60s alert_120s alert_180s alert_300s alert_600s </CODE></PRE> <P>The FlashChart module just puts up legend items in the order it gets them, so all you have to do is change the order with <CODE>fields</CODE> or <CODE>table</CODE></P> <P>The little wildcard terms are telling splunk to put all the hidden 'underscore' columns first, then any other columns, and then finally end the sequence with the specified columns. If you'd rather specify the columns explicitly you can of course do that. Note that the fields clause seems to damage timechart now, in that the _time field can get removed if you leave off _* or _time... </P> Sun, 06 Mar 2011 05:04:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-specify-the-order-of-fields-legend-in-a-chart/m-p/101312#M26180 sideview 2011-03-06T05:04:55Z https://community.splunk.com/t5/Splunk-Search/How-to-specify-the-order-of-fields-legend-in-a-chart/m-p/101313#M26181 <P>This is all very fine if you know what the fields will be.<BR /> But what about inverting the order of fields dynamically?<BR /> "sort" doesn't work.</P> Wed, 05 Jun 2013 23:54:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-specify-the-order-of-fields-legend-in-a-chart/m-p/101313#M26181 sansay 2013-06-05T23:54:56Z