Splunk Search

How do you display response time results sorted in descending order ?

navd
New Member

I am trying to display response times in a chart for my services. But, how do I display the response times results in chart in descending order (Highest number first)?

<myBaseSearch> | eval Date=strftime(_time, "%Y-%m-%d")  | chart avg(response_time) over services by Date  | rename * as avg_*  | rename avg_services as services   | foreach avg_* [eval "<<FIELD>>"= round('<<FIELD>>',2)]  | rename avg_* as *
0 Karma
1 Solution

mayurr98
Super Champion

hey @navd,

You can not do that if you have multiple services , because you have got multiple columns and you are actually sorting on multiple columns which is logically not possible.

However, you can sort on 1 column(1 service) using | sort - servicename but other columns will automatically adjust.

let me know if this helps!

View solution in original post

mayurr98
Super Champion

hey @navd,

You can not do that if you have multiple services , because you have got multiple columns and you are actually sorting on multiple columns which is logically not possible.

However, you can sort on 1 column(1 service) using | sort - servicename but other columns will automatically adjust.

let me know if this helps!

navd
New Member

Ya now I understand why my sorting didn't work . Thank you

0 Karma

woodcock
Esteemed Legend

Add this to the end:

| sort 0 - YourFieldWithCountHere
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...