Splunk Search

How to change the order of fields when chart is used

nnonm111
Path Finder

index="www1" sourcetype="access_combined_wcookie" action=* status<=400
| timechart span=1d count(action) by clientip useother=f
| addtotals
| eval type = if(Total>90 ,"UP","DOWN")
| fields _time 194.* *.*.*.* Total type
| sort - _time

 

I want to change the order of the x-axis field names when using it.
| fields _time 194.* *.*.*.* Total type   Is there any other way than this?

Labels (2)
0 Karma
1 Solution

codebuilder
Influencer

If I understand your question correctly, fields are displayed in the order which you define them.
So if you use this for example:

| fields Total 194.* *.*.*.* type _time

 
Then you'll see Total displayed first and _time last.

----
An upvote would be appreciated and Accept Solution if it helps!

View solution in original post

0 Karma

codebuilder
Influencer

If I understand your question correctly, fields are displayed in the order which you define them.
So if you use this for example:

| fields Total 194.* *.*.*.* type _time

 
Then you'll see Total displayed first and _time last.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...