How to sort column headers in timechart?

[HeinzWaescher]

Hi,

I've got a timechart with several columns. The headers of these columns are numbers (0,1,2,3... etc) and I would like to sort the columns ascending. With the sort command it doesn't work, perhaps somebody can help me here 🙂

Thanks in advance

Heinz

[chakuttha]

Thank you so much.

Best Regards,

CR

[alacercogitatus · Accepted solution]

Fields can be "sorted" using the fields command.

your_search | fields col0 col1 col2 col3 col4 col5

Per http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/Createandmaintainsearch-timefieldextractio..., you may not have fields that begin with 0-9.

Field names cannot begin with 0-9 or _ . Leading underscores are reserved for Splunk Enterprise's internal variables.

=EDIT=

Based on your comment, I can say that they are sorted by numeral already, just that it is based on the beginning number. To do what you want, do this:

your_search | eval tt = case(X<10,"00".X,X<100,"0".X,1=1,X) | timechart count by tt

Add additional case statements for each increase in the tens place, and make sure the padding is correct.

[alacercogitatus]

If this has answered your question, please mark it accepted. Thanks!

[alacercogitatus]

The "." is combining the string "0" with the value of X. The last pair makes sure that anything not matching in the case statement will assign the value of X to the field "tt", to make sure they are all there.

[HeinzWaescher]

This seems to work fine, thanks!

To get sure, that I understand what I'm doing here:
Could you explain why are we using a "dot" in the the Y argument? And what's the use last pair "(1=1,X)?

[alacercogitatus]

See edit above.

[HeinzWaescher]

hi,

thanks for your answer. The headers are values of a field "X", which I create during my search. The command looks like this:

| timechart span=1d dc(user) by X

So it's not about sorting fields, but sorting the values of field X (which are the column headers in the shown chart).