Dashboards & Visualizations

## How to sort fields ?

Path Finder

I am currently using a bar chart visualization but I need to sort the bars by descending order.

I can't use a simple  chart count by EVNTSEVCAT | sort -count  because the SEVCAT field contains multiple values and we only need I,II, and III.

below is my query

search *
| eval CATI = if(SEVCAT=="I", 1,0)
| eval CATII = if(SEVCAT=="II", 1,0)
| eval CATIII = if(SEVCAT=="III", 1,0)
| chart sum(CATI) sum(CATII) sum(CATIII)
| transpose

The visualization:

I need the visualization to be sorted in descending order. Any suggestions help :-).

Thank you,

Marco

Labels (2)

• ### simple XML

1 Solution
SplunkTrust
| sort 0 - "row 1"
| fields - cat
SplunkTrust

Do you mean sort the names in descending order or the values in descending order?

Path Finder

The values in descending order.

The table below represents my bar chart:

 sum(CATI) sum(CATII) sum(CATIII) 7 141 3

I want the bar chart to sort it out in descending order, so that way sum(CATII) shows first, sum(CATI) second, ,and sum(CATIII) third

-Marco

SplunkTrust
| sort 0 - "row 1"
| fields - cat
Path Finder

@ITWhisperer  Thank you I modified it a bit and it works. For people in the future, this is the final query, with the final visualization.

search *
| eval CATI = if(SEVCAT=="I", 1,0)
| eval CATII = if(SEVCAT=="II", 1,0)
| eval CATIII = if(SEVCAT=="III", 1,0)
| chart sum(CATI) sum(CATII) sum(CATIII)
| transpose
| sort - "row 1"

-Marco

Get Updates on the Splunk Community!

#### Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

#### Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...