Dashboards & Visualizations

addcoltotals floats the label column to the right

rijhwani
Explorer

Search:

index=_internal source=*license_usage.log | eval ISODate=strftime(strptime(date_year."-".date_month."-".date_mday, "%Y-%b-%d"), "%Y-%m-%d (%a)") | eval MB=b/1024/1024 | chart eval(round(sum(MB),0)) over i by ISODate limit=0 | addcoltotals labelfield=i

I'm not sure the ISODate evaluation is the best way to achieve my end, but that is not the issue here. The problem is that when I use this chart, the column with the indexer UIDs is floated to the rightmost position in the table (presumably due to the fact that a simple alphanumeric string sort puts the dates before the letter "i"). What I need is to anchor the indexer column to the left regardless.

Tags (2)
1 Solution

rijhwani
Explorer

OK, so it only floats right during the real time aggregation. On completion it floats back left.

Odd behaviour, and not documented anywhere I could find.

View solution in original post

rijhwani
Explorer

OK, so it only floats right during the real time aggregation. On completion it floats back left.

Odd behaviour, and not documented anywhere I could find.

Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...