How to rearrange the columns of a cart command

[Trishant]

I have used this query-

sourcetype="sample data_ui performance" boxtype= "cisco*" build="RC24" | sort +iteration| eval testId = testId + ": " + testcase |
rename testId as Test_CaseID, build as Build, duration as Time_Taken |
chart values(Time_Taken) over Test_CaseID by iteration limit=20 |

and as a result I got

Now I want to rearrange the columns like 1, 2, 3, 4 and so on. How to do so?? I have tried sort but it didin't work.

[niketn · Accepted solution]

@Trishant, you can pad zero to iterations to make them sort as numerical strings i.e. 01, 02, 03... 10, 11 ...

Following example uses printf() function to pad 0 if length of String number is less than 2. printf("%02d",iteration)

sourcetype="sample data_ui performance" boxtype= "cisco*" build="RC24" 
| eval iteration=printf("%02d",iteration)
| eval testId = testId + ": " + testcase 
| rename testId as Test_CaseID, build as Build, duration as Time_Taken 
| chart values(Time_Taken) over Test_CaseID by iteration limit=20

You do not need sort + iteration on second line as mentioned in your search.

While this is just an option, the solution by @DalJeanis is best approach for your scenario. It does not require additional evaluation and it applies sort after dataset is narrowed down to specific results.

[Trishant]

Many Thanks, this worked for me..

[niketn]

@Trishant, glad it worked. Did you try @DalJeanis's answer?

[Trishant]

Yeah I tried that as well but,I am not sure why sort command is not working for my query..

[somesoni2]

The chart/timechart/xyseries etc command automatically sorts the column names, treating them as string. There can be a workaround but it's based on assumption that the column names are known and fixed. You can basically add a table command at the end of your search with list of columns in the proper order.

your current search with chart command
| table Test_CaseID 1 2 3 4 5 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

OR

your current search with chart command
| table Test_CaseID [| gentimes start=-1 | eval search=mvrange(1,21) | stats list(search) as search delim="," | nomv search ]

[DalJeanis]

It is sorting the iterations as strings rather than numbers.

try this

 | sort + num(iteration)