Splunk Search

How can I control the order of results on a chart or timechart?


I have a timechart that is based on count by score, where score is a whole number between 0 and 10. Every time I make a chart, the order shows up as:


I've tried sorting the results by score, but 10 never appears at the end of the results. I tried to use covert num(score) and sort the results but 10 is still showing up between 1 and 2 instead of at the end of the results.

What am I doing wrong?


Tags (1)

Splunk Employee
Splunk Employee

It appears that even if you force score to a numeric value, the sort is always calculated as if the values are strings. This causes the 10 to order between 1 and 2, rather than after 9. Even when using | sort - num(score). I've filed a support ticket.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!