just using this silly/simple example for illustration
this is the search
| makeresults count=5 | streamstats count as a | eval a=a+1 | streamstats count as d | eval d=d+10 |streamstats count as b | eval b=b+10 | streamstats count as c | eval c=c+11 |
and it gives me the below:
the legend reads a->d top to bottom and in the graph left to right.
How do I reverse this? How do I get it to read d->a, top to bottom in the legend, and d->a left to right in the graph?
Try something like this
| gentimes start=-5 | streamstats count as a | eval a=a+1 | streamstats count as d | eval d=d+10 |streamstats count as b | eval b=b+10 | streamstats count as c | eval c=c+11 | rename starttime as _time | table _time d c b a
Update
There is a work around where you can sort the column dynamically but it would add a sequence number in the column name. Something like this
| gentimes start=-5 | streamstats count as a | eval a=a+1 | streamstats count as d | eval d=d+10 |streamstats count as b | eval b=b+10 | streamstats count as c | eval c=c+11 | rename starttime as _time | table _time a b c d
| untable _time metrics value | sort _time -metrics | streamstats count as rank by _time | eval metrics=rank."-".metrics | xyseries _time metrics value
first two lines are to generate data.
tks. why rename starttime as _time
it seems to work just using table _time d c b a
But I should have said in the question, I am looking for it to work on dynamic data, so don't want it hardcoded. Is there a way to do it with dynamic data?
Means the columns names are dynamic?? By default the field names displayed are (generally after a reporting command) sorted alphabatically.
Means the columns names are dynamic?? So if the the fields are a,b,c,d then i have to hard code this with table _time d c b a
to reverse it as the default is to sort it alphabetically. what if the fields where q,r,s,t, my search would not work or if the fields where 6,7,8,9.
I want to be able to control the sorting no matte what the fields are. Can this be done without hardcoding?
hmm tks for the update, not a bad work around but I'm hoping there is a better way.