Splunk Search

How to order the bars within each time segment of a timechart (bar style) by the sum of the field from largest to smallest?

antonyhan
Path Finder

I am trying to order the bars within each time segment from largest to smallest?
is there a way of doing it?

0 Karma

meenal901
Communicator

timechart will not be able to do this. Just plain stats would help you with ordering based on values, but will not have _time in this case:

sourcetype=test2| stats sum(Count) as Count by Name| sort - Count

Data:
Name,Count
A,100
B,1000
C,10

0 Karma

emiller42
Motivator

This may not be helpful, but I would strongly advise against doing this. Having the bars potentially change order with every time-slice would make the overall presentation confusing and difficult to parse.

antonyhan
Path Finder

you got a point! it's a customer request and I couldn't figure out a solution.
is there a way to do with just regular chart?

0 Karma

somesoni2
Revered Legend

Could you explain more about expected output by some sample values?

0 Karma

antonyhan
Path Finder

say with in 5 mins we have A100, B 1000, C 50. right now plain vanilla timechart with bar will order by legend name. Instead of the order of A B C, we would like to see an order of BAC from top to bottom as B has the largest value. Hope this explains.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...