Splunk Search

How to re-arrange a bar chart

jhoang
Path Finder

Hi,

I would like to sort my bar chart's by the following sequence, (Intensive, Intermediate, Minimal, Moderate). However it is currently being sorted alphabetically (Intensive, Intermediate, Minimal, Moderate.)

Below is my current search function:

index="sdp" Level !="Not Assigned" Urgency="*" | chart count over Level by Urgency | eval Level=if(Level="Intensive", "1. Intensive", if(Level="Intermediate","2. Intermediate", if(Level="Moderate","3. Moderate", if(Level="Minimal", "4. Minimal"

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

Put the eval before the chart, like this

index="sdp" Level !="Not Assigned" Urgency="*" 
| eval Level=if(Level="Intensive", "1. Intensive", 
             if(Level="Intermediate","2. Intermediate", 
              if(Level="Moderate","3. Moderate",
            if(Level="Minimal", "4. Minimal"))))
| chart count by Level Urgency 

View solution in original post

0 Karma

somesoni2
Revered Legend

I don't see any difference in your expected and current sort order. Do you expect Intensive, Intermediate, Moderate, Minimal as final sorting??? If yes, then @Iguinn's answer will give you correct sort order, after you update the expected sequence in that.

0 Karma

jhoang
Path Finder

Yea, that is correct, but when I ran Inguinn query, I received error message (Error in 'eval' command: The arguments to the 'if' function are invalid.)

0 Karma

chimell
Motivator

Hi
try this search code

index="sdp" Level !="Not Assigned" Urgency="*" | chart count over Level by Urgency | eval Level=case(Level=="Intensive", "1. Intensive", Level=="Intermediate","2. Intermediate", Level=="Moderate","3. Moderate", Level=="Minimal", "4. Minimal")
0 Karma

jhoang
Path Finder

Hi Chimell,

The above query added the values to the different urgency (1,2,3,4) but it is still being arranged in :

1)intensive
2) intermediate
4) Minimal
3) moderate

0 Karma

jhoang
Path Finder

Hi Chimell,

Any update on this?

0 Karma

lguinn2
Legend

Put the eval before the chart, like this

index="sdp" Level !="Not Assigned" Urgency="*" 
| eval Level=if(Level="Intensive", "1. Intensive", 
             if(Level="Intermediate","2. Intermediate", 
              if(Level="Moderate","3. Moderate",
            if(Level="Minimal", "4. Minimal"))))
| chart count by Level Urgency 
0 Karma

jhoang
Path Finder

Hi Iguinn,

Another agent is helping me on this item, thank you.

0 Karma

somesoni2
Revered Legend

Here is same query with case instead of if.

index="sdp" Level !="Not Assigned" Urgency="*"  | eval Level=case(Level="Intensive", "1. Intensive", Level="Intermediate","2. Intermediate",Level="Moderate","3. Moderate", Level="Minimal", "4. Minimal", 1=1, "5. Not defined") | chart count by Level Urgency 

Make sure the numbering is as per your need.

0 Karma

jhoang
Path Finder

it worked!!!! Thank you Somesoni2!!!

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...