Why is the sort function not saving properly in dashboard panels?

[twmoffit]

Hello,

I am having an issue where I want to sort my data in a chart but for some reason when I save and close the dashboard, my sort removed a " " (space) from the search. Here is an example,

I save the search as this and the largest 10 items return in my visualization:

....
| chart sum(FREE_GB) sum(USED_GB) over TS_NAME
| sort 10 -num("sum(USED_GB)")

However, when I save and then close or refresh the dashboard, ALL of the sorts on the dashboard change to this:

....
| chart sum(FREE_GB) sum(USED_GB) over TS_NAME
| sort 10-num("sum(USED_GB)")

Notice the space has been removed between "10 -num(..."

How do I stop this from happening? Is this just a bug in Splunk or is there something wrong with my syntax??
Thanks,

[jplumsdaine22]

This is a bug, fixed in 6.5.4 (see discussion here: https://answers.splunk.com/answers/547674/splunk-bug-fields-command.html)

See SPL-140551, SPL-140828, SPL-140807 in fixed issues here: http://docs.splunk.com/Documentation/Splunk/6.5.4/ReleaseNotes/6.5.4

After upgrading I recommend you run the following command so you can identify any affected dashboards and fix them on the filesystem.

find $SPLUNK_HOME/etc/users $SPLUNK_HOME/etc/apps -type f -name '*.xml' -exec grep -lr 'sort-\|fields-' {} +

[niketn]

@twmoffit, we had noticed this issue with Internet Explorer (IE), however, the same worked fine with Chrome. Can you try that?

This seemed like a bug with IE.

[twmoffit]

Changing and saving the search in Chrome seemed to have fixed the problem for now. I hope this gets patched at some point soon though.

[niketn]

@twmoffit, did you check out, @jplumsdaine22 's answer that this bug has already been fixed in 6.5.4. If you are using 6.5.4 or later and still observe the issue you should report the same to Splunk Support through your Entitlement. Kindly upvote if this work-around has helped.

Also if you can upgrade to 6.5.4 or later then test and accept jplumsdaine22's answer.

[jplumsdaine22]

It has been patched (see below) However you will need to manually fix affected boards.

[somesoni2]

Can you try like this?

....
 | chart sum(FREE_GB) as sum_FREE_GB sum(USED_GB) as sum_USED_GB by TS_NAME
 | sort 10 -num(sum_USED_GB)

OR just

....
 | chart sum(FREE_GB) as sum_FREE_GB sum(USED_GB) as sum_USED_GB by TS_NAME
 | sort 10 -sum_USED_GB

[rjthibod]

What version of Splunk are you running and what browser?