Splunk Search

How to change the order of fields when chart is used

nnonm111
Path Finder

index="www1" sourcetype="access_combined_wcookie" action=* status<=400
| timechart span=1d count(action) by clientip useother=f
| addtotals
| eval type = if(Total>90 ,"UP","DOWN")
| fields _time 194.* *.*.*.* Total type
| sort - _time

 

I want to change the order of the x-axis field names when using it.
| fields _time 194.* *.*.*.* Total type   Is there any other way than this?

Labels (2)
0 Karma
1 Solution

codebuilder
SplunkTrust
SplunkTrust

If I understand your question correctly, fields are displayed in the order which you define them.
So if you use this for example:

| fields Total 194.* *.*.*.* type _time

 
Then you'll see Total displayed first and _time last.

----
An upvote would be appreciated and Accept Solution if it helps!

View solution in original post

0 Karma

codebuilder
SplunkTrust
SplunkTrust

If I understand your question correctly, fields are displayed in the order which you define them.
So if you use this for example:

| fields Total 194.* *.*.*.* type _time

 
Then you'll see Total displayed first and _time last.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma