Timechart value is coming same even after Sorting

[aditsss]

Hi Everyone,

I have two queries as shown below. For both I am doing sorting in different ways but stil there values are coming same.

index=abc source="/splunkLogs/JOB_MDJX_CS_STATS_PLATINUM.csv"|join type=outer JOBFLOW_ID [ inputlookup JOB_MDJX_CS_MASTER_E3.csv ]|eval fields=split(_raw,",")|eval Environment=mvindex(fields,11)|eval JOBFLOW_ID=mvindex(fields,0) |eval JOB_EXEC_TIME=mvindex(fields,8)|eval RunDate=mvindex(fields,3)|where Environment="E3"|where JOBFLOW_ID LIKE "%%"|eval RunDate="20".mvindex(fields,3)|fieldformat Run_Date=strftime(Run_Date,"%d/%b/%Y")|eval TotalExecTime=round(TotalExecTime,2)|timechart useother=f sum(JOB_EXEC_TIME) as TotalExecTime by JOBFLOW_ID |sort -TotalExecTime limit=10

index=abc source="/splunkLogs/JOB_MDJX_CS_STATS_PLATINUM.csv"|join type=outer JOBFLOW_ID [ inputlookup JOB_MDJX_CS_MASTER_E3.csv ]|eval fields=split(_raw,",")|eval Environment=mvindex(fields,11)|eval JOBFLOW_ID=mvindex(fields,0) |eval JOB_EXEC_TIME=mvindex(fields,8)|eval RunDate=mvindex(fields,3)|where Environment="E3"|where JOBFLOW_ID LIKE "%%"|eval RunDate="20".mvindex(fields,3)|fieldformat Run_Date=strftime(Run_Date,"%d/%b/%Y")|eval TotalExecTime=round(TotalExecTime,2)|timechart useother=f sum(JOB_EXEC_TIME) as TotalExecTime by JOBFLOW_ID |sort TotalExecTime limit=10

Why there values are coming same can someone guide me.

Thanks in advance

[gcusello]

HI @aditsss,

because if you use the BY clause in a timechart or stats command, the name of the columns are the values of the field you used in the BY clause and not TotalExecTime so the sort command hasn't any effect.

Using timechart command you can sort only by the _time (when you have the BY clause).

Ciao.

Giuseppe