topic Re: Sort for chart not working in Splunk Search

Sort for chart not working

JeremyHagan — Thu, 13 Oct 2016 06:00:04 GMT

Hi,
I'm doing a search on the _internal index for license usage by host. I'd like the histogram to have the biggest values of X by Y on the left and I've been searching here for half an hour and it seems that what I am trying to do should be working, but it isn't.
Can anyone point out the issue?

Here is my search:
index=_internal source=*license_usage.log type=Usage | eval MB = round(b/1024/1024,1) | chart sum(MB) as MegaBytes by h | rename h as device | sort –MegaBytes

Re: Sort for chart not working

gokadroid — Tue, 29 Sep 2020 11:22:26 GMT

Minus sign is too close to MegaBytes.
Can you try this



|sort - MegaBytes

Adding complete query if above was not self explanatory:



index=_internal source=*license_usage.log type=Usage | eval MB = round(b/1024/1024,1) | chart sum(MB) as MegaBytes by h | rename h as device | sort – MegaBytes

Re: Sort for chart not working

hunters_splunk — Thu, 13 Oct 2016 07:29:54 GMT

Hi Jeremy,

Aside from creating your own search query, you can also view license usage information in DMC:

In Splunk Web, select Settings from the menu and click Monitoring Console.
From the DMC menu, select Indexing > License Usage > License Usage - Previous 30 days to view license usage statistics and charts in the past month.

Hope it helps. Thanks!
Hunter

Re: Sort for chart not working

pavankumarh — Tue, 29 Sep 2020 11:24:57 GMT

i copy pasted your query and it didn't sort. i just deleted the "-" character before MegaBytes and typed it again.
the search query gave me sorted results. Strange Though.

index=_internal source=*license_usage.log type=Usage | eval MB = round(b/1024/1024,1) | chart sum(MB) as MegaBytes by h | rename h as device | sort -MegaBytes

Re: Sort for chart not working

gokadroid — Thu, 13 Oct 2016 14:56:58 GMT

Hi Pavan,
In the answer I gave I mentioned how will it sort with - sign. Please try that.

Re: Sort for chart not working

vikashforsrm — Thu, 13 Oct 2016 19:12:46 GMT

Minus sign with space in between seems to work!

Re: Sort for chart not working

JeremyHagan — Thu, 13 Oct 2016 22:42:22 GMT

Actually that is wrong. It turns out an en-dash managed to creep into my search from copy/paste. You don't need a space between the minus and the sort field.

Re: Sort for chart not working

JeremyHagan — Thu, 13 Oct 2016 22:44:41 GMT

You are correct. Turns out an en-dash crept into my search.

PS C:\> [int][char]'–'
8211
PS C:\> [int][char]'-'
45

Re: Sort for chart not working

gokadroid — Thu, 13 Oct 2016 23:05:15 GMT

@JeremyHagan - So which answer is acceptable. this one on which I commented or the one I actually answered 🙂 which is down below

Re: Sort for chart not working

gokadroid — Thu, 13 Oct 2016 23:08:01 GMT

But to have the biggest histogram bar on the left most (which was your question) you have to sort it with en-dash(minus) else the requirement of the question is not fulfilled whether u have the space or not. So kind of get what u r saying..

I quote like you stated
Id like the histogram to have the biggest values of X by Y on the left "

Re: Sort for chart not working

JeremyHagan — Thu, 13 Oct 2016 23:49:11 GMT

"minus sign too close to MegaBytes" is not the answer. No space is required between the minus and the sort field. It works with or without the space between the minus and the sort field.

Re: Sort for chart not working

JeremyHagan — Thu, 13 Oct 2016 23:51:10 GMT

Pavan's response was correct. gokadroid was not.