Splunk Search

How do I adjust the command so that the columns are ordered numerically in a chart?

GrahamHay
New Member

I am generating a basic chart with the following command:

index=test | eval latency = (_indextime - _time) | chart count by latency span=10

The order of the columns in the chart seems to be lexical so I get:

0-10,10-20,100-110,110-120, ...

How do I adjust the command so that the columns are ordered numerically?

0-10,10-20,20-30,30-40, ...

NB: there are too many bins for a solution using "rename" to be practical.

Many thanks
Graham

0 Karma
1 Solution

Vijeta
Influencer

sort latency, should work

View solution in original post

0 Karma

Vijeta
Influencer

sort latency, should work

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

AI + Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...