Splunk Search
Highlighted

Can't get my chart to sort

Engager

Here is my query

index="myIndex" AND host="myHost" AND ObjectName="myObjectName"
| eval secondsEpoch = GroupDateTime/1000
| eval displayDate=strftime(secondsEpoch,"%m-%d %H:%M")
| chart sum(RecordCount) over CallingClass by displayDate
| sort 0 -GroupDateTime
alt text

GroupDateTime is a time that I am logging to splunk it contains an epoch time in milliseconds.

No matter how I sort my data it comes out looking like this. What I want is the latest date on the left column. I have even tried to chart by CallingClass over GroupDateTime and that doesn't work either. I even tried _time.

I have tried for several days to get this to work and can't find a solutions. I suspect it is probably something easy.
I am new to splunk so some solutions I didn't understand or couldn't get to work.

0 Karma
Highlighted

Re: Can't get my chart to sort

Ultra Champion
index="myIndex" AND host="myHost" AND ObjectName="myObjectName"
| eval secondsEpoch = GroupDateTime/1000
| eval displayDate=strftime(secondsEpoch,"%m-%d %H:%M")
|chart limit=0 useother=f usenull=f sum(RecordCount) as RecordCount by displayDate CallingClass
|sort 0 - displayDate
|transpose 0 header_field=displayDate column_name=CallingClass

View solution in original post

Highlighted

Re: Can't get my chart to sort

Engager

That's the ticket! Thank you so much! Now I can look into the things I don't understand and learn from this!

0 Karma