index="www1" sourcetype="access_combined_wcookie" action=* status<=400
| timechart span=1d count(action) by clientip useother=f
| addtotals
| eval type = if(Total>90 ,"UP","DOWN")
| fields _time 194.* *.*.*.* Total type
| sort - _time
I want to change the order of the x-axis field names when using it.
| fields _time 194.* *.*.*.* Total type Is there any other way than this?
If I understand your question correctly, fields are displayed in the order which you define them.
So if you use this for example:
| fields Total 194.* *.*.*.* type _time
Then you'll see Total displayed first and _time last.
If I understand your question correctly, fields are displayed in the order which you define them.
So if you use this for example:
| fields Total 194.* *.*.*.* type _time
Then you'll see Total displayed first and _time last.