Splunk Search

Arrange fields in bar chart in specific order

jangid
Builder

Search is

<param name="search">eventtype="metrics" | stats count(eval(JobStatus="JOB.FINISHED")) as JobCompleted, count(eval(JobStatus="JOB.PENDING")) as JobPending by Stage | eval total=(JobCompleted/JobPending)*100 | chart values(total) as "Percentage" by Stage | lookup stage_lookup Stage OUTPUT StageName | fields - Stage | table StageName, Percentage | rename StageName as "Stage Name"</param>

it'll display bar chart in following order

Application - x% graph
System  - x% graph
Online  - x% graph
Report  - x% graph
SOD     - x% graph

I want to change the order to following

Application - x% graph
SOD    - x% graph
Report - x% graph
System - x% graph
Online - x% graph

Thanks

Tags (1)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

You may find a better answer here:
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/sort

but I solve using eval below: (most will recommend case instead of if)
http://docs.splunk.com/Documentation/Splunk/5.0.1/searchreference/eval
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/CommonEvalFunctions

| eval StageNameNew=if(StageName="Application","1. Application",if(StageName="SOD","2. SOD",if(StageName="Report","3. Report",if(StageName="System","4. System",if(StageName="Online","5. Online","Other or Unknown Stage")))))| table StageNameNew, Percentage | rename StageNameNew as StageName

View solution in original post

Kenshiro70
Path Finder

Use the fields command, like so:

| table StageName Percentage
| chart max(Percentage) as Percentage by StageName
| transpose column_name="Title" header_field=StageName
| fields Title Application SOD Report System Online

Note that I had to use transpose to move the Percentage values to columns. For timecharts, you wouldn't need to do that.

0 Karma

jkat54
SplunkTrust
SplunkTrust

You may find a better answer here:
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/sort

but I solve using eval below: (most will recommend case instead of if)
http://docs.splunk.com/Documentation/Splunk/5.0.1/searchreference/eval
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/CommonEvalFunctions

| eval StageNameNew=if(StageName="Application","1. Application",if(StageName="SOD","2. SOD",if(StageName="Report","3. Report",if(StageName="System","4. System",if(StageName="Online","5. Online","Other or Unknown Stage")))))| table StageNameNew, Percentage | rename StageNameNew as StageName

jkat54
SplunkTrust
SplunkTrust

Awesome, glad to help, thanks for marking my answer as the accepted solution.

0 Karma

jangid
Builder

I did it in another way but it was not possible without your above solution.

Thanks

0 Karma

agoriawala_splu
Splunk Employee
Splunk Employee

Can you post your answer please?

0 Karma

jangid
Builder

Thanks jkat54
UI looks very ugly and I don't want to any prefix before Job type.

Is there any other alternate? How Splunk decide the field order?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...