Splunk Search

How to re-arrange a bar chart

jhoang
Path Finder

Hi,

I would like to sort my bar chart's by the following sequence, (Intensive, Intermediate, Minimal, Moderate). However it is currently being sorted alphabetically (Intensive, Intermediate, Minimal, Moderate.)

Below is my current search function:

index="sdp" Level !="Not Assigned" Urgency="*" | chart count over Level by Urgency | eval Level=if(Level="Intensive", "1. Intensive", if(Level="Intermediate","2. Intermediate", if(Level="Moderate","3. Moderate", if(Level="Minimal", "4. Minimal"

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

Put the eval before the chart, like this

index="sdp" Level !="Not Assigned" Urgency="*" 
| eval Level=if(Level="Intensive", "1. Intensive", 
             if(Level="Intermediate","2. Intermediate", 
              if(Level="Moderate","3. Moderate",
            if(Level="Minimal", "4. Minimal"))))
| chart count by Level Urgency 

View solution in original post

0 Karma

somesoni2
Revered Legend

I don't see any difference in your expected and current sort order. Do you expect Intensive, Intermediate, Moderate, Minimal as final sorting??? If yes, then @Iguinn's answer will give you correct sort order, after you update the expected sequence in that.

0 Karma

jhoang
Path Finder

Yea, that is correct, but when I ran Inguinn query, I received error message (Error in 'eval' command: The arguments to the 'if' function are invalid.)

0 Karma

chimell
Motivator

Hi
try this search code

index="sdp" Level !="Not Assigned" Urgency="*" | chart count over Level by Urgency | eval Level=case(Level=="Intensive", "1. Intensive", Level=="Intermediate","2. Intermediate", Level=="Moderate","3. Moderate", Level=="Minimal", "4. Minimal")
0 Karma

jhoang
Path Finder

Hi Chimell,

The above query added the values to the different urgency (1,2,3,4) but it is still being arranged in :

1)intensive
2) intermediate
4) Minimal
3) moderate

0 Karma

jhoang
Path Finder

Hi Chimell,

Any update on this?

0 Karma

lguinn2
Legend

Put the eval before the chart, like this

index="sdp" Level !="Not Assigned" Urgency="*" 
| eval Level=if(Level="Intensive", "1. Intensive", 
             if(Level="Intermediate","2. Intermediate", 
              if(Level="Moderate","3. Moderate",
            if(Level="Minimal", "4. Minimal"))))
| chart count by Level Urgency 
0 Karma

jhoang
Path Finder

Hi Iguinn,

Another agent is helping me on this item, thank you.

0 Karma

somesoni2
Revered Legend

Here is same query with case instead of if.

index="sdp" Level !="Not Assigned" Urgency="*"  | eval Level=case(Level="Intensive", "1. Intensive", Level="Intermediate","2. Intermediate",Level="Moderate","3. Moderate", Level="Minimal", "4. Minimal", 1=1, "5. Not defined") | chart count by Level Urgency 

Make sure the numbering is as per your need.

0 Karma

jhoang
Path Finder

it worked!!!! Thank you Somesoni2!!!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...