Dashboards & Visualizations

Timechart value is coming same even after Sorting

aditsss
Motivator

Hi Everyone,

I have two queries as shown below. For both I am doing sorting in different ways but stil there values are coming same.

index=abc source="/splunkLogs/JOB_MDJX_CS_STATS_PLATINUM.csv"|join type=outer JOBFLOW_ID [ inputlookup JOB_MDJX_CS_MASTER_E3.csv ]|eval fields=split(_raw,",")|eval Environment=mvindex(fields,11)|eval JOBFLOW_ID=mvindex(fields,0) |eval JOB_EXEC_TIME=mvindex(fields,8)|eval RunDate=mvindex(fields,3)|where Environment="E3"|where JOBFLOW_ID LIKE "%%"|eval RunDate="20".mvindex(fields,3)|fieldformat Run_Date=strftime(Run_Date,"%d/%b/%Y")|eval TotalExecTime=round(TotalExecTime,2)|timechart useother=f sum(JOB_EXEC_TIME) as TotalExecTime by JOBFLOW_ID |sort -TotalExecTime limit=10

 

 

index=abc source="/splunkLogs/JOB_MDJX_CS_STATS_PLATINUM.csv"|join type=outer JOBFLOW_ID [ inputlookup JOB_MDJX_CS_MASTER_E3.csv ]|eval fields=split(_raw,",")|eval Environment=mvindex(fields,11)|eval JOBFLOW_ID=mvindex(fields,0) |eval JOB_EXEC_TIME=mvindex(fields,8)|eval RunDate=mvindex(fields,3)|where Environment="E3"|where JOBFLOW_ID LIKE "%%"|eval RunDate="20".mvindex(fields,3)|fieldformat Run_Date=strftime(Run_Date,"%d/%b/%Y")|eval TotalExecTime=round(TotalExecTime,2)|timechart useother=f sum(JOB_EXEC_TIME) as TotalExecTime by JOBFLOW_ID |sort TotalExecTime limit=10

Why there values are coming same can someone guide me.

Thanks in advance

 

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

HI @aditsss,

because if you use the BY clause in a timechart or stats command, the name of the columns are the values of the field you used in the BY clause and not TotalExecTime so the sort command hasn't any effect.

Using timechart command you can sort only by the _time (when you have the BY clause).

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...