topic Re: Sort column headers in timechart in Splunk Search

How to sort column headers in timechart?

HeinzWaescher — Thu, 27 Oct 2022 13:45:30 GMT

Hi,

I've got a timechart with several columns. The headers of these columns are numbers (0,1,2,3... etc) and I would like to sort the columns ascending. With the sort command it doesn't work, perhaps somebody can help me here 🙂

Thanks in advance

Heinz

Re: Sort column headers in timechart

alacercogitatus — Wed, 04 Dec 2013 12:23:59 GMT

Fields can be "sorted" using the fields command.

your_search | fields col0 col1 col2 col3 col4 col5

Per http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles#Use_proper_field_name_syntax, you may not have fields that begin with 0-9.

Field names cannot begin with 0-9 or _ . Leading underscores are reserved for Splunk Enterprise's internal variables.

=EDIT=

Based on your comment, I can say that they are sorted by numeral already, just that it is based on the beginning number. To do what you want, do this:

your_search | eval tt = case(X<10,"00".X,X<100,"0".X,1=1,X) | timechart count by tt

Add additional case statements for each increase in the tens place, and make sure the padding is correct.

Re: Sort column headers in timechart

HeinzWaescher — Wed, 04 Dec 2013 13:09:16 GMT

hi,

thanks for your answer. The headers are values of a field "X", which I create during my search. The command looks like this:

| timechart span=1d dc(user) by X

So it's not about sorting fields, but sorting the values of field X (which are the column headers in the shown chart).

Re: Sort column headers in timechart

alacercogitatus — Wed, 04 Dec 2013 15:15:08 GMT

See edit above.

Re: Sort column headers in timechart

HeinzWaescher — Wed, 04 Dec 2013 15:55:59 GMT

This seems to work fine, thanks!

To get sure, that I understand what I'm doing here:
Could you explain why are we using a "dot" in the the Y argument? And what's the use last pair "(1=1,X)?

Re: Sort column headers in timechart

alacercogitatus — Wed, 04 Dec 2013 16:14:13 GMT

The "." is combining the string "0" with the value of X. The last pair makes sure that anything not matching in the case statement will assign the value of X to the field "tt", to make sure they are all there.

Re: Sort column headers in timechart

alacercogitatus — Wed, 04 Dec 2013 16:52:06 GMT

If this has answered your question, please mark it accepted. Thanks!

Re: Sort column headers in timechart

chakuttha — Thu, 27 Oct 2022 02:33:32 GMT

Thank you so much.

Best Regards,