topic Re: How do I sort a timechart legend by count in decreasing order, not alphabetically? in Splunk Search

How do I sort a timechart legend by count in decreasing order, not alphabetically?

jofish — Sat, 21 May 2016 00:16:21 GMT

Let's say I've got a timechart of URLs I'm serving. Over an hour, let's say I served this:

server.com/MYcats.html - 22 hits
server.com/MYdogs.html - 50 hits
server.com/MYrabbits.html - 10 hits

I would like the legend of my timechart to list those colored lines in order of number of hits:

dogs
cats
rabbits

But it sorts alphabetically. Here's [a shortened version of] my search:

index=myindex page_uri=*.html | rex field=page_uri "(?(?i)MY(\d)+)" | timechart count by animal

Can someone help? I've looked through previous answers and haven't found the right thing.

Thanks

Re: How do I sort a timechart legend by count in decreasing order, not alphabetically?

sundareshr — Sat, 21 May 2016 01:28:33 GMT

Unfortunately, short of hard coding the sequence of columns, splunk will default to sort alphabetically. However, its is possible to rename the cols so they appear in the right order, like this...

   index=myindex page_uri=*.html | rex field=page_uri "(?(?i)MY(\d)+)" | timechart count by animal | untable _time animal count | eventstats sum(count) as total by animal | sort - total | delta total as d | streamstats count(eval(d!=0)) as grp | eval animal=grp."-".animial | xyseries _time animal count

This does add a number prefix to the column name.

Re: How do I sort a timechart legend by count in decreasing order, not alphabetically?

gmorris_splunk — Tue, 07 May 2019 14:42:30 GMT

If you have more than 9 in the legend add the following:
| eval grp=if(len(grp)=1,"0".grp,grp)