Let's say I've got a timechart of URLs I'm serving. Over an hour, let's say I served this:
server.com/MYcats.html - 22 hits
server.com/MYdogs.html - 50 hits
server.com/MYrabbits.html - 10 hits
I would like the legend of my timechart to list those colored lines in order of number of hits:
dogs
cats
rabbits
But it sorts alphabetically. Here's [a shortened version of] my search:
index=myindex page_uri=*.html | rex field=page_uri "(?(?i)MY(\d)+)" | timechart count by animal
Can someone help? I've looked through previous answers and haven't found the right thing.
Thanks
Unfortunately, short of hard coding the sequence of columns, splunk will default to sort alphabetically. However, its is possible to rename the cols so they appear in the right order, like this...
index=myindex page_uri=*.html | rex field=page_uri "(?(?i)MY(\d)+)" | timechart count by animal | untable _time animal count | eventstats sum(count) as total by animal | sort - total | delta total as d | streamstats count(eval(d!=0)) as grp | eval animal=grp."-".animial | xyseries _time animal count
This does add a number prefix to the column name.
If you have more than 9 in the legend add the following:
| eval grp=if(len(grp)=1,"0".grp,grp)