topic Re: How to sort columns values(Desc) for a column chart in decreasing order? in Splunk Search

How to sort columns values(Desc) for a column chart in decreasing order?

rahhali22 — Wed, 03 Feb 2016 10:35:25 GMT

Hello,

I wanna know if it's possible to sort columns in decreasing order in a column chart.

Thanks in advance for your help

Re: How to sort columns values(Desc) for a column chart in decreasing order?

tom_frotscher — Wed, 03 Feb 2016 15:00:01 GMT

Hi, simply put a sort command behind your search something like this:

... | sort column_name

you can control desc order with a minus:

... | sort -column_name

Re: How to sort columns values(Desc) for a column chart in decreasing order?

somesoni2 — Wed, 03 Feb 2016 15:51:20 GMT

Further reading from here. http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Sort

Re: How to sort columns values(Desc) for a column chart in decreasing order?

rahhali22 — Thu, 04 Feb 2016 15:51:39 GMT

Actually, I want to sort the columns of column chart by value, I don't know if it's possible or not

Re: How to sort columns values(Desc) for a column chart in decreasing order?

tom_frotscher — Thu, 04 Feb 2016 16:02:50 GMT

Maybe i don't understand what your problem is, but for me, this is what it does.

https://answers.splunk.com/storage/attachments/97182-no-sort.png

https://answers.splunk.com/storage/attachments/97183-sort.png

Re: How to sort columns values(Desc) for a column chart in decreasing order?

rahhali22 — Thu, 04 Feb 2016 16:08:38 GMT

Gooood (Y)
Thanks 🙂

Re: How to sort columns values(Desc) for a column chart in decreasing order?

rahhali22 — Thu, 04 Feb 2016 16:54:32 GMT

It doesn't work for me this is my query

   <query>index=aut_kpi2 $servicesToken$ $catalogToken$ $subscriptionToken$ | timechart span=$spanToken$ count by service_offering_name</query>
   <earliest>$timeToken.earliest$</earliest>
   <latest>$timeToken.latest$</latest

Re: How to sort columns values(Desc) for a column chart in decreasing order?

tom_frotscher — Thu, 04 Feb 2016 16:58:14 GMT

You used timechart, which is used to calculate values over time buckets. You cant reorder the time, it makes no sense. Take stats instead of timechart.

Re: How to sort columns values(Desc) for a column chart in decreasing order?

somesoni2 — Tue, 29 Sep 2020 08:40:19 GMT

There can be multiple columns based on different values of service_offering_name. Which one do you want to sort upon?

Re: How to sort columns values(Desc) for a column chart in decreasing order?

rahhali22 — Thu, 04 Feb 2016 17:12:08 GMT

but i want something depends on date

Re: How to sort columns values(Desc) for a column chart in decreasing order?

rahhali22 — Tue, 29 Sep 2020 08:39:42 GMT

i want to sort my columns basing on the value of service_offering_name

Re: How to sort columns values(Desc) for a column chart in decreasing order?

somesoni2 — Thu, 04 Feb 2016 18:01:23 GMT

How many different values that fields can have and are they contant?? The timechart will create a field with value as the name (e.g. sourcetype=splunkd and sourcetype=scheduler , when used in timechart there will be fields named _time, splunkd and scheduler).

Re: How to sort columns values(Desc) for a column chart in decreasing order?

blachow — Tue, 23 Jan 2018 13:36:01 GMT

Thank you. Exactly what I needed.
One column ranked by priority (Asc), the other by the length of the event (desc)

Re: How to sort columns values(Desc) for a column chart in decreasing order?

maca007 — Wed, 29 May 2019 00:17:31 GMT

The above used to work for me. That is, simply use "sort" to order the stats under in the Statistics tab and then the Visualisation tab would graph them in the sort order.

This stopped working, I think, after an upgrade of Splunk (we are now running version 7.2.4). What I get now is Count Vs Time (aka similar to the first screen grab regardless of the sort order).

Has anyone else experienced this? And is there a work around (I simply want a graph similar to the second screen grab above)?