Dashboards & Visualizations

sort bars in a chart so that Yesterday's bar is on the left of Today's bar for each value of "over" field

nickrally2009
Explorer

I have this search, and it works correctly:

 source=foo resource=bar earliest=-1d@d latest=now
 | eval Day=if(_time<relative_time(now(),"@d"),"Yesterday","Today")
 | rex max_match=0 "(?:'id': )(?P<id>[^,]+)|(?:'usage': )(?P<usage>[^,]+)"
 | chart max(usage) over id by Day | where Yesterday!=Today | sort Today

It shows Today's bar on the left of Yesterday's bar for each id. I tried to reverse the order, to show Yesterday's bar on the left of Today's bar for each id, but did not find a way to make it work unless I rename the column(s), e.g. rename "Yesterday" to "Before" and rename "Today" to "Now". It appears that the default behavior is to sort in alphabetical order. Is there a better way to do this?
Thank you

Tags (2)
1 Solution

niketn
Legend

Try the following.

   source=foo resource=bar earliest=-1d@d latest=now
  | eval Day=if(_time<relative_time(now(),"@d"),"1.Yesterday","2.Today")
  | rex max_match=0 "(?:'id': )(?P<id>[^,]+)|(?:'usage': )(?P<usage>[^,]+)"
  | chart max(usage) over id by Day 
  | where "1.Yesterday"!="2.Today"
  | rename "1.Yesterday" as "Yesterday" "2.Today" as Today
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

woodcock
Esteemed Legend

Add this:

... | rename Yesterday AS " Yesterday"

Adding the space will re-order the fields but be invisible.

nickrally2009
Explorer

Thank you, that's clever, will keep that in mind.
I accepted niketnilay's answer because it was first. In the end I did not use rename but used

| table, id, Yesterday, Today
0 Karma

woodcock
Esteemed Legend

Curses, foiled again! Thanks for the UpVote! 😆

0 Karma

niketn
Legend

Try the following.

   source=foo resource=bar earliest=-1d@d latest=now
  | eval Day=if(_time<relative_time(now(),"@d"),"1.Yesterday","2.Today")
  | rex max_match=0 "(?:'id': )(?P<id>[^,]+)|(?:'usage': )(?P<usage>[^,]+)"
  | chart max(usage) over id by Day 
  | where "1.Yesterday"!="2.Today"
  | rename "1.Yesterday" as "Yesterday" "2.Today" as Today
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

nickrally2009
Explorer

Thank you @niketnilay . I used Before and Now instead of Yesterday and Today respectively as an alternative to renaming, hoped there is a sort variation that could reverse the order instead of renaming.
There is also another way: | table, id, Yesterday, Today

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...