Hi, I am new to Splunk. I have a stacked column chart after issuing this query:
(index="A" OR index="B")
| chart count(Level) over _time span=1mon by Level usenull=f useother=f
where Level has four values: 1,2,3,4
The chart is like this:
As you can see the stack order is now 2 > 3 > 4 (from top to bottom), what if I want to reverse it to display like 4 > 3 > 2 (from top to bottom). I have seen similar questions here using transpose or reverse, I tried follow but still have no luck. Could anyone help?
appendcols will sort the column names again.
Try it outside the appendcols
(index="A" OR index="B")
| eval Satisfaction = if(Satisfaction="good with comment", "good", Satisfaction)
| eval Satisfaction = if(Satisfaction="bad with comment", "bad", Satisfaction)
| chart count(Satisfaction) over _time span=1mon by Satisfaction usenull=f useother=f
| appendcols
[ | search (index="A" OR index="B")
| chart count(Level) over _time span=1mon by Level usenull=f useother=f ]
| transpose 0 header_field=_time column_name=Level
| reverse
| transpose 0 header_field=Level column_name=_time
The visualisation with put the bars in the order of the fields, first at the top.
Chart with order the fields in a sorted order, so in your case 1 will be first (and therefore top of the stack).
To rectify this, you could try this
| transpose 0 header_field=_time column_name=level
| reverse
| transpose 0 header_field=level column_name=_time
thanks for the reply. It worked. But what if I put it in chart overlay, like this:
(index="A" OR index="B")
| eval Satisfaction = if(Satisfaction="good with comment", "good", Satisfaction)
| eval Satisfaction = if(Satisfaction="bad with comment", "bad", Satisfaction)
| chart count(Satisfaction) over _time span=1mon by Satisfaction usenull=f useother=f
| appendcols
[ | search (index="A" OR index="B")
| chart count(Level) over _time span=1mon by Level usenull=f useother=f ]
where Level is from index A and Satisfaction is from index B. The chart like this:
I tried to wrap your suggestions in the appendcols cause this is column chart part where I want to reverse the order but it seemed won't work.
appendcols will sort the column names again.
Try it outside the appendcols
(index="A" OR index="B")
| eval Satisfaction = if(Satisfaction="good with comment", "good", Satisfaction)
| eval Satisfaction = if(Satisfaction="bad with comment", "bad", Satisfaction)
| chart count(Satisfaction) over _time span=1mon by Satisfaction usenull=f useother=f
| appendcols
[ | search (index="A" OR index="B")
| chart count(Level) over _time span=1mon by Level usenull=f useother=f ]
| transpose 0 header_field=_time column_name=Level
| reverse
| transpose 0 header_field=Level column_name=_time
Thank you. It worked.