Splunk Search

How to change the order of fields when chart is used

nnonm111
Path Finder

index="www1" sourcetype="access_combined_wcookie" action=* status<=400
| timechart span=1d count(action) by clientip useother=f
| addtotals
| eval type = if(Total>90 ,"UP","DOWN")
| fields _time 194.* *.*.*.* Total type
| sort - _time

 

I want to change the order of the x-axis field names when using it.
| fields _time 194.* *.*.*.* Total type   Is there any other way than this?

Labels (2)
0 Karma
1 Solution

codebuilder
Influencer

If I understand your question correctly, fields are displayed in the order which you define them.
So if you use this for example:

| fields Total 194.* *.*.*.* type _time

 
Then you'll see Total displayed first and _time last.

----
An upvote would be appreciated and Accept Solution if it helps!

View solution in original post

0 Karma

codebuilder
Influencer

If I understand your question correctly, fields are displayed in the order which you define them.
So if you use this for example:

| fields Total 194.* *.*.*.* type _time

 
Then you'll see Total displayed first and _time last.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...