Splunk Search

Changing the sorting order of a chart

Communicator

I got a stacked bar chart from the following search:
... | chart count by "field1" "field2"
On the X-axis I have field2 which is a bunch of numeric values, currently like 0..1..10
That what I want to change to go descending 10..0.
Tried the sort command, or doing like chart count by -field2, but that didn't work.
How can I achieve that?

Tags (1)
0 Karma
1 Solution

Motivator

Here you go :

 ...| chart count by "field1" "field2"|reverse

View solution in original post

0 Karma

Motivator

Here you go :

 ...| chart count by "field1" "field2"|reverse

View solution in original post

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!