How to sort columns values(Desc) for a column chart in decreasing order?

[rahhali22]

Hello,

I wanna know if it's possible to sort columns in decreasing order in a column chart.

Thanks in advance for your help

[tom_frotscher]

Maybe i don't understand what your problem is, but for me, this is what it does.

https://answers.splunk.com/storage/attachments/97182-no-sort.png

https://answers.splunk.com/storage/attachments/97183-sort.png

[maca007]

The above used to work for me. That is, simply use "sort" to order the stats under in the Statistics tab and then the Visualisation tab would graph them in the sort order.

This stopped working, I think, after an upgrade of Splunk (we are now running version 7.2.4). What I get now is Count Vs Time (aka similar to the first screen grab regardless of the sort order).

Has anyone else experienced this? And is there a work around (I simply want a graph similar to the second screen grab above)?

[rahhali22]

It doesn't work for me this is my query

   <query>index=aut_kpi2 $servicesToken$ $catalogToken$ $subscriptionToken$ | timechart span=$spanToken$ count by service_offering_name</query>
   <earliest>$timeToken.earliest$</earliest>
   <latest>$timeToken.latest$</latest

[somesoni2]

There can be multiple columns based on different values of service_offering_name. Which one do you want to sort upon?

[rahhali22]

i want to sort my columns basing on the value of service_offering_name

[somesoni2]

How many different values that fields can have and are they contant?? The timechart will create a field with value as the name (e.g. sourcetype=splunkd and sourcetype=scheduler , when used in timechart there will be fields named _time, splunkd and scheduler).

[tom_frotscher]

You used timechart, which is used to calculate values over time buckets. You cant reorder the time, it makes no sense. Take stats instead of timechart.

[rahhali22]

but i want something depends on date

[rahhali22]

Gooood (Y)
Thanks 🙂

[tom_frotscher]

Hi, simply put a sort command behind your search something like this:

... | sort column_name

you can control desc order with a minus:

... | sort -column_name

[somesoni2]

Further reading from here. http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Sort

[blachow]

Thank you. Exactly what I needed.
One column ranked by priority (Asc), the other by the length of the event (desc)

[rahhali22]

Actually, I want to sort the columns of column chart by value, I don't know if it's possible or not