How do I sort a timechart legend by count in decreasing order, not alphabetically?

[jofish]

Let's say I've got a timechart of URLs I'm serving. Over an hour, let's say I served this:

server.com/MYcats.html - 22 hits
server.com/MYdogs.html - 50 hits
server.com/MYrabbits.html - 10 hits

I would like the legend of my timechart to list those colored lines in order of number of hits:

dogs
cats
rabbits

But it sorts alphabetically. Here's [a shortened version of] my search:

index=myindex page_uri=*.html | rex field=page_uri "(?(?i)MY(\d)+)" | timechart count by animal

Can someone help? I've looked through previous answers and haven't found the right thing.

Thanks

[sundareshr]

Unfortunately, short of hard coding the sequence of columns, splunk will default to sort alphabetically. However, its is possible to rename the cols so they appear in the right order, like this...

   index=myindex page_uri=*.html | rex field=page_uri "(?(?i)MY(\d)+)" | timechart count by animal | untable _time animal count | eventstats sum(count) as total by animal | sort - total | delta total as d | streamstats count(eval(d!=0)) as grp | eval animal=grp."-".animial | xyseries _time animal count

This does add a number prefix to the column name.

[gmorris_splunk]

If you have more than 9 in the legend add the following:
| eval grp=if(len(grp)=1,"0".grp,grp)