topic Re: Chart using span logs does not show the columns in range order in Splunk Search

Chart using span logs does not show the columns in range order

srenou — Thu, 18 May 2017 10:20:04 GMT

Hello,
I am trying to chart some response time and wanted to use the log span as:

index=myIndex "time_value" | chart count by time_ms bins=100 span=2log5

My concern is that Splunk seems to be doing some alphabetical sorting which mixes my span ranges

for example it shows the span in the order of :
0 10-50 1250-6250 250-1250
while I would expect:
0 10-50 250-1250 1250-6250

Thanks for any help.
Stephane

Re: Chart using span logs does not show the columns in range order

woodcock — Thu, 18 May 2017 15:20:58 GMT

You can fix this after the fact, like this:

| rename 0 AS "   0" "10-50" AS "  10-50" "250-1250" AS " 250-1250"

Note that 0 has been renamed with 3 leading spaces and 10-50 with just two (and so on until 1250-6250 is not renamed at all, so it has 0 spaces).
The whitespace is invisible in the chart but forces the alphabetical order that you desire.

Re: Chart using span logs does not show the columns in range order

srenou — Fri, 19 May 2017 10:26:42 GMT

thanks for the proposal, unfortunately that does not seem to work for me as the names are not getting changed with that process. I guess the chart is done before the rename and rename gets no effect. Looking at the splunk sample, http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Chart#9:_Chart_the_average_number_of_events_in_a_transaction.2C_based_on_transaction_duration I am getting a different result as the statistics data are not sorted on my side on my example, so I guess I may have some configuration issue or an invalid release.

Re: Chart using span logs does not show the columns in range order

woodcock — Fri, 19 May 2017 14:14:37 GMT

If you are running a fileds or table command, the fields may be re-sorted. Try stripping off the commands after the chart command to see where the resorting happens and see if you can use a different command or perhaps that command has a keepcolorder option (some commands do).

Re: Chart using span logs does not show the columns in range order

srenou — Fri, 19 May 2017 16:04:48 GMT

Thanks for the feedback.
unfortunately no. My request is just an index search piped to a chart count by MyCounter span=2log5.

My graph is strangely sorted as well as my statistics as if it is doing alphabetical sorting instead of looking at the ranges.
But that drove me to thinking that I should force the sorting, so adding sort MyCounter that made the trick.
Thanks again.

Re: Chart using span logs does not show the columns in range order

woodcock — Fri, 19 May 2017 20:10:52 GMT

So what exactly was your final search?

Re: Chart using span logs does not show the columns in range order

srenou — Tue, 29 Sep 2020 14:09:52 GMT

My final search is:
index=myIndex "time_value" | chart count by time_ms bins=100 span=2log5 | sort time_ms bins

Re: Chart using span logs does not show the columns in range order

woodcock — Mon, 22 May 2017 19:11:47 GMT

You need sort 0, not just sort.

Re: Chart using span logs does not show the columns in range order

srenou — Tue, 23 May 2017 09:00:40 GMT

Thanks for the feedback, strangely in my case the sort with the value is enough.