Dashboards & Visualizations

How to sort fields ?

Marco_Develops
Path Finder

I am currently using a bar chart visualization but I need to sort the bars by descending order. 

I can't use a simple  chart count by EVNTSEVCAT | sort -count  because the SEVCAT field contains multiple values and we only need I,II, and III.

below is my query

 

 

 

 

search * 
| eval CATI = if(SEVCAT=="I", 1,0) 
| eval CATII = if(SEVCAT=="II", 1,0) 
| eval CATIII = if(SEVCAT=="III", 1,0) 
| chart sum(CATI) sum(CATII) sum(CATIII)
| transpose

 

 

 

 

 

The visualization:

sort.PNG

 

I need the visualization to be sorted in descending order. Any suggestions help :-).

 

Thank you,

Marco

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| transpose 0 header_field=cat column_name=cat
| sort 0 - "row 1"
| transpose 0 header_field=cat column_name=cat
| fields - cat

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Do you mean sort the names in descending order or the values in descending order?

0 Karma

Marco_Develops
Path Finder

The values in descending order. 

The table below represents my bar chart: 

sum(CATI)sum(CATII)sum(CATIII)
71413

 

I want the bar chart to sort it out in descending order, so that way sum(CATII) shows first, sum(CATI) second, ,and sum(CATIII) third

 

-Marco 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| transpose 0 header_field=cat column_name=cat
| sort 0 - "row 1"
| transpose 0 header_field=cat column_name=cat
| fields - cat

Marco_Develops
Path Finder

@ITWhisperer  Thank you I modified it a bit and it works. For people in the future, this is the final query, with the final visualization.

search * 
| eval CATI = if(SEVCAT=="I", 1,0) 
| eval CATII = if(SEVCAT=="II", 1,0) 
| eval CATIII = if(SEVCAT=="III", 1,0) 
| chart sum(CATI) sum(CATII) sum(CATIII)
| transpose
| sort - "row 1"

 

final.PNG

 

-Marco 

0 Karma
Get Updates on the Splunk Community!

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...