Dashboards & Visualizations

how do i contol the order of items in the legend

HattrickNZ
Motivator

just using this silly/simple example for illustration

this is the search
| makeresults count=5 | streamstats count as a | eval a=a+1 | streamstats count as d | eval d=d+10 |streamstats count as b | eval b=b+10 | streamstats count as c | eval c=c+11 |

and it gives me the below:
alt text

the legend reads a->d top to bottom and in the graph left to right.
How do I reverse this? How do I get it to read d->a, top to bottom in the legend, and d->a left to right in the graph?

Tags (2)
0 Karma

somesoni2
Revered Legend

Try something like this

| gentimes start=-5 | streamstats count as a | eval a=a+1 | streamstats count as d | eval d=d+10 |streamstats count as b | eval b=b+10 | streamstats count as c | eval c=c+11 | rename starttime as _time | table _time d c b a

alt text

Update
There is a work around where you can sort the column dynamically but it would add a sequence number in the column name. Something like this

| gentimes start=-5 | streamstats count as a | eval a=a+1 | streamstats count as d | eval d=d+10 |streamstats count as b | eval b=b+10 | streamstats count as c | eval c=c+11 | rename starttime as _time | table _time a b c d 
| untable _time metrics value | sort _time -metrics | streamstats count as rank by _time | eval metrics=rank."-".metrics | xyseries _time metrics value

first two lines are to generate data.

HattrickNZ
Motivator

tks. why rename starttime as _time it seems to work just using table _time d c b a
But I should have said in the question, I am looking for it to work on dynamic data, so don't want it hardcoded. Is there a way to do it with dynamic data?

0 Karma

somesoni2
Revered Legend

Means the columns names are dynamic?? By default the field names displayed are (generally after a reporting command) sorted alphabatically.

0 Karma

HattrickNZ
Motivator

Means the columns names are dynamic?? So if the the fields are a,b,c,d then i have to hard code this with table _time d c b a to reverse it as the default is to sort it alphabetically. what if the fields where q,r,s,t, my search would not work or if the fields where 6,7,8,9.

I want to be able to control the sorting no matte what the fields are. Can this be done without hardcoding?

0 Karma

HattrickNZ
Motivator

hmm tks for the update, not a bad work around but I'm hoping there is a better way.

0 Karma
Get Updates on the Splunk Community!

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...