Splunk Search

How do you display response time results sorted in descending order ?

navd
New Member

I am trying to display response times in a chart for my services. But, how do I display the response times results in chart in descending order (Highest number first)?

<myBaseSearch> | eval Date=strftime(_time, "%Y-%m-%d")  | chart avg(response_time) over services by Date  | rename * as avg_*  | rename avg_services as services   | foreach avg_* [eval "<<FIELD>>"= round('<<FIELD>>',2)]  | rename avg_* as *
0 Karma
1 Solution

mayurr98
Super Champion

hey @navd,

You can not do that if you have multiple services , because you have got multiple columns and you are actually sorting on multiple columns which is logically not possible.

However, you can sort on 1 column(1 service) using | sort - servicename but other columns will automatically adjust.

let me know if this helps!

View solution in original post

mayurr98
Super Champion

hey @navd,

You can not do that if you have multiple services , because you have got multiple columns and you are actually sorting on multiple columns which is logically not possible.

However, you can sort on 1 column(1 service) using | sort - servicename but other columns will automatically adjust.

let me know if this helps!

navd
New Member

Ya now I understand why my sorting didn't work . Thank you

0 Karma

woodcock
Esteemed Legend

Add this to the end:

| sort 0 - YourFieldWithCountHere
0 Karma
Get Updates on the Splunk Community!

Buttercup Games Tutorial Extension - part 9

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games Tutorial Extension - part 8

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Introducing the Splunk Developer Program!

Hey Splunk community! We are excited to announce that Splunk is launching the Splunk Developer Program in ...