topic Re: Timechart's Table Column Header - Sorted in Descending Order in Splunk Search

Timechart's Table Column Header - Sorted in Descending Order

syslogap — Tue, 06 Nov 2012 00:40:35 GMT

Hi,

I'm using version 4.2.2 with the search query:

host = "JA8*" AND eventtype="firewall*" earliest=7/1/2011:0:0:0 | dedup _raw | timechart count by host span=month limit=20

This produces a timechart with the table header sorted in descending order - "time, JA827J, JA826J, JA825J, JA822J, JA812A, JA810A, ...". Is there anything I can do to get the table header sorted in ascending order - "_time, JA810A, JA812A, JA822J, JA825J, ..." besides upgrading to 5.0 where this issue doesn't occur?

It appears descending order is being caused by using "limit" in the search query. I have more than 10 hosts so not using "limit" isn't an option as far as I understand it.

Thanks in advance for any help.

JForhan

Re: Timechart's Table Column Header - Sorted in Descending Order

martin_mueller — Tue, 06 Nov 2012 10:02:11 GMT

You can specify the field order with the fields command, it might just require listing every field name.

Re: Timechart's Table Column Header - Sorted in Descending Order

syslogap — Tue, 06 Nov 2012 19:36:40 GMT

Thanks. That suffices as a work-around until we upgrade.

Re: Timechart's Table Column Header - Sorted in Descending Order

yong_ly — Mon, 28 Sep 2020 12:59:20 GMT

have you tried the sort command?

host = "JA8*" AND eventtype="firewall*" earliest=7/1/2011:0:0:0 | dedup _raw | timechart count by host span=month limit=20 | sort by host DESC

Re: Timechart's Table Column Header - Sorted in Descending Order

martin_mueller — Wed, 19 Dec 2012 08:08:16 GMT

sort sorts rows, not columns.