Reverse Stacked Order of Column Chart

[itnewbie]

Hi, I am new to Splunk. I have a stacked column chart after issuing this query: 

(index="A" OR index="B") 
    | chart count(Level) over _time span=1mon by Level usenull=f useother=f

where Level has four values: 1,2,3,4

The chart is like this: 

As you can see the stack order is now 2 > 3 > 4 (from top to bottom), what if I want to reverse it to display like 4 > 3 > 2 (from top to bottom). I have seen similar questions here using transpose or reverse, I tried follow but still have no luck. Could anyone help? 

[ITWhisperer]

The visualisation with put the bars in the order of the fields, first at the top.

Chart with order the fields in a sorted order, so in your case 1 will be first (and therefore top of the stack).

To rectify this, you could try this

| transpose 0 header_field=_time column_name=level
| reverse
| transpose 0 header_field=level column_name=_time

[itnewbie]

thanks for the reply. It worked. But what if I put it in chart overlay, like this:

(index="A" OR index="B")  
| eval Satisfaction = if(Satisfaction="good with comment", "good", Satisfaction)
| eval Satisfaction = if(Satisfaction="bad with comment", "bad", Satisfaction)
| chart  count(Satisfaction) over _time span=1mon by Satisfaction usenull=f useother=f   
| appendcols  
[ | search (index="A" OR index="B") 
| chart count(Level) over _time span=1mon by Level usenull=f useother=f ]

 where Level is from index A and Satisfaction is from index B. The chart like this:

I tried to wrap your suggestions in the appendcols cause this is column chart part where I want to reverse the order  but it seemed won't work. 

[ITWhisperer · Accepted solution]

appendcols will sort the column names again.

Try it outside the appendcols

(index="A" OR index="B")  
| eval Satisfaction = if(Satisfaction="good with comment", "good", Satisfaction)
| eval Satisfaction = if(Satisfaction="bad with comment", "bad", Satisfaction)
| chart  count(Satisfaction) over _time span=1mon by Satisfaction usenull=f useother=f   
| appendcols  
[ | search (index="A" OR index="B") 
| chart count(Level) over _time span=1mon by Level usenull=f useother=f ]
| transpose 0 header_field=_time column_name=Level
| reverse
| transpose 0 header_field=Level column_name=_time

[itnewbie]

Thank you. It worked.