Ordering a bar chart by value, not name

[wsw70]

Hello,

I have a bar chart and it displays as

  |
| |
| | |
a b c

While I would like to have

| 
| |
| | |
b a c

ie. sorted by the value of the bar and not by its name. I searched for "order bar chart", "sort bar chart" but somehow I seem to be the only one having such metaphysical problems 🙂
Any ideas?

Thanks!

[cphair · Accepted solution]

Hi wsw,

If you pipe your search to "| sort - Value" (or whatever the field is called), then graph it as a bar chart, it should sort automatically. Does this work for you?

[cphair]

Well, a timechart is always going to show the same order of events on the x-axis because time doesn't change. Are you trying to order the bars within each time segment from largest to smallest?

[AlexMcDuffMille]

It still doesn't seem to work:

(host, sourcetype, yada yada) | multikv fields PRODUCER HOST | timechart span=1d avg(TRANSFERS) as TRANSFERS by HOST | sort - TRANSFERS

[cphair]

You need to name the averaged field something. timechart span=1d avg(TRANSFERS) as TRANSFERS by HOST should work.

[AlexMcDuffMille]

I take the average of a field called 'TRANSFERS' so for me my search is "timechart span=1d avg(TRANSFERS) by HOST"

If I add "| sort - TRANSFERS" it doesn't do anything differently.

Any ideas?