Splunk Search

Arrange fields in bar chart in specific order

jangid
Builder

Search is

<param name="search">eventtype="metrics" | stats count(eval(JobStatus="JOB.FINISHED")) as JobCompleted, count(eval(JobStatus="JOB.PENDING")) as JobPending by Stage | eval total=(JobCompleted/JobPending)*100 | chart values(total) as "Percentage" by Stage | lookup stage_lookup Stage OUTPUT StageName | fields - Stage | table StageName, Percentage | rename StageName as "Stage Name"</param>

it'll display bar chart in following order

Application - x% graph
System  - x% graph
Online  - x% graph
Report  - x% graph
SOD     - x% graph

I want to change the order to following

Application - x% graph
SOD    - x% graph
Report - x% graph
System - x% graph
Online - x% graph

Thanks

Tags (1)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

You may find a better answer here:
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/sort

but I solve using eval below: (most will recommend case instead of if)
http://docs.splunk.com/Documentation/Splunk/5.0.1/searchreference/eval
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/CommonEvalFunctions

| eval StageNameNew=if(StageName="Application","1. Application",if(StageName="SOD","2. SOD",if(StageName="Report","3. Report",if(StageName="System","4. System",if(StageName="Online","5. Online","Other or Unknown Stage")))))| table StageNameNew, Percentage | rename StageNameNew as StageName

View solution in original post

Kenshiro70
Path Finder

Use the fields command, like so:

| table StageName Percentage
| chart max(Percentage) as Percentage by StageName
| transpose column_name="Title" header_field=StageName
| fields Title Application SOD Report System Online

Note that I had to use transpose to move the Percentage values to columns. For timecharts, you wouldn't need to do that.

0 Karma

jkat54
SplunkTrust
SplunkTrust

You may find a better answer here:
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/sort

but I solve using eval below: (most will recommend case instead of if)
http://docs.splunk.com/Documentation/Splunk/5.0.1/searchreference/eval
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/CommonEvalFunctions

| eval StageNameNew=if(StageName="Application","1. Application",if(StageName="SOD","2. SOD",if(StageName="Report","3. Report",if(StageName="System","4. System",if(StageName="Online","5. Online","Other or Unknown Stage")))))| table StageNameNew, Percentage | rename StageNameNew as StageName

jkat54
SplunkTrust
SplunkTrust

Awesome, glad to help, thanks for marking my answer as the accepted solution.

0 Karma

jangid
Builder

I did it in another way but it was not possible without your above solution.

Thanks

0 Karma

agoriawala_splu
Splunk Employee
Splunk Employee

Can you post your answer please?

0 Karma

jangid
Builder

Thanks jkat54
UI looks very ugly and I don't want to any prefix before Job type.

Is there any other alternate? How Splunk decide the field order?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...