Timechart Sort Asc/Desc

[kavyakanne]

After timechart can the columns be sorted either in Ascending/Descending order

[ITWhisperer · Accepted solution]

You need to have your column named numerically, then transpose, sort, and transpose back again. If you need to you can reset the numeric values after the sort

| makeresults count=5000
| eval response=random()%30
| streamstats count as row 
| eval _time=_time-(row%60)*60
| timechart limit=0 useother=f count by response



| transpose 0 header_field=_time
| sort 0 column
| where column!="_span"
| transpose 0 header_field=column column_name=_time

[kavyakanne]

ok!

[ITWhisperer]

Try the solution I proposed - transpose, sort, (remove system-generated field), transpose

[johnhuang]

When you generate the hour range, convert 1 digit hour to 2 digit, e.g. 00-01, 01-02, etc.