Dashboards & Visualizations

how do i contol the order of items in the legend

HattrickNZ
Motivator

just using this silly/simple example for illustration

this is the search
| makeresults count=5 | streamstats count as a | eval a=a+1 | streamstats count as d | eval d=d+10 |streamstats count as b | eval b=b+10 | streamstats count as c | eval c=c+11 |

and it gives me the below:
alt text

the legend reads a->d top to bottom and in the graph left to right.
How do I reverse this? How do I get it to read d->a, top to bottom in the legend, and d->a left to right in the graph?

Tags (2)
0 Karma

somesoni2
Revered Legend

Try something like this

| gentimes start=-5 | streamstats count as a | eval a=a+1 | streamstats count as d | eval d=d+10 |streamstats count as b | eval b=b+10 | streamstats count as c | eval c=c+11 | rename starttime as _time | table _time d c b a

alt text

Update
There is a work around where you can sort the column dynamically but it would add a sequence number in the column name. Something like this

| gentimes start=-5 | streamstats count as a | eval a=a+1 | streamstats count as d | eval d=d+10 |streamstats count as b | eval b=b+10 | streamstats count as c | eval c=c+11 | rename starttime as _time | table _time a b c d 
| untable _time metrics value | sort _time -metrics | streamstats count as rank by _time | eval metrics=rank."-".metrics | xyseries _time metrics value

first two lines are to generate data.

HattrickNZ
Motivator

tks. why rename starttime as _time it seems to work just using table _time d c b a
But I should have said in the question, I am looking for it to work on dynamic data, so don't want it hardcoded. Is there a way to do it with dynamic data?

0 Karma

somesoni2
Revered Legend

Means the columns names are dynamic?? By default the field names displayed are (generally after a reporting command) sorted alphabatically.

0 Karma

HattrickNZ
Motivator

Means the columns names are dynamic?? So if the the fields are a,b,c,d then i have to hard code this with table _time d c b a to reverse it as the default is to sort it alphabetically. what if the fields where q,r,s,t, my search would not work or if the fields where 6,7,8,9.

I want to be able to control the sorting no matte what the fields are. Can this be done without hardcoding?

0 Karma

HattrickNZ
Motivator

hmm tks for the update, not a bad work around but I'm hoping there is a better way.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...