Search is
<param name="search">eventtype="metrics" | stats count(eval(JobStatus="JOB.FINISHED")) as JobCompleted, count(eval(JobStatus="JOB.PENDING")) as JobPending by Stage | eval total=(JobCompleted/JobPending)*100 | chart values(total) as "Percentage" by Stage | lookup stage_lookup Stage OUTPUT StageName | fields - Stage | table StageName, Percentage | rename StageName as "Stage Name"</param>
it'll display bar chart in following order
Application - x% graph
System - x% graph
Online - x% graph
Report - x% graph
SOD - x% graph
I want to change the order to following
Application - x% graph
SOD - x% graph
Report - x% graph
System - x% graph
Online - x% graph
Thanks
You may find a better answer here:
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/sort
but I solve using eval below: (most will recommend case instead of if)
http://docs.splunk.com/Documentation/Splunk/5.0.1/searchreference/eval
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/CommonEvalFunctions
| eval StageNameNew=if(StageName="Application","1. Application",if(StageName="SOD","2. SOD",if(StageName="Report","3. Report",if(StageName="System","4. System",if(StageName="Online","5. Online","Other or Unknown Stage")))))| table StageNameNew, Percentage | rename StageNameNew as StageName
Use the fields
command, like so:
| table StageName Percentage
| chart max(Percentage) as Percentage by StageName
| transpose column_name="Title" header_field=StageName
| fields Title Application SOD Report System Online
Note that I had to use transpose
to move the Percentage values to columns. For timecharts, you wouldn't need to do that.
You may find a better answer here:
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/sort
but I solve using eval below: (most will recommend case instead of if)
http://docs.splunk.com/Documentation/Splunk/5.0.1/searchreference/eval
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/CommonEvalFunctions
| eval StageNameNew=if(StageName="Application","1. Application",if(StageName="SOD","2. SOD",if(StageName="Report","3. Report",if(StageName="System","4. System",if(StageName="Online","5. Online","Other or Unknown Stage")))))| table StageNameNew, Percentage | rename StageNameNew as StageName
Awesome, glad to help, thanks for marking my answer as the accepted solution.
I did it in another way but it was not possible without your above solution.
Thanks
Can you post your answer please?
Thanks jkat54
UI looks very ugly and I don't want to any prefix before Job type.
Is there any other alternate? How Splunk decide the field order?