Splunk Search

How to sort columns values(Desc) for a column chart in decreasing order?

New Member

Hello,

I wanna know if it's possible to sort columns in decreasing order in a column chart.

Thanks in advance for your help

0 Karma

Maybe i don't understand what your problem is, but for me, this is what it does.

alt text
https://answers.splunk.com/storage/attachments/97182-no-sort.png

alt text
https://answers.splunk.com/storage/attachments/97183-sort.png

New Member

The above used to work for me. That is, simply use "sort" to order the stats under in the Statistics tab and then the Visualisation tab would graph them in the sort order.

This stopped working, I think, after an upgrade of Splunk (we are now running version 7.2.4). What I get now is Count Vs Time (aka similar to the first screen grab regardless of the sort order).

Has anyone else experienced this? And is there a work around (I simply want a graph similar to the second screen grab above)?

0 Karma

New Member

It doesn't work for me this is my query

   <query>index=aut_kpi2 $servicesToken$ $catalogToken$ $subscriptionToken$ | timechart span=$spanToken$ count by service_offering_name</query>
   <earliest>$timeToken.earliest$</earliest>
   <latest>$timeToken.latest$</latest
0 Karma

Revered Legend

There can be multiple columns based on different values of service_offering_name. Which one do you want to sort upon?

0 Karma

New Member

i want to sort my columns basing on the value of service_offering_name

0 Karma

Revered Legend

How many different values that fields can have and are they contant?? The timechart will create a field with value as the name (e.g. sourcetype=splunkd and sourcetype=scheduler , when used in timechart there will be fields named _time, splunkd and scheduler).

0 Karma

You used timechart, which is used to calculate values over time buckets. You cant reorder the time, it makes no sense. Take stats instead of timechart.

0 Karma

New Member

but i want something depends on date

0 Karma

New Member

Gooood (Y)
Thanks 🙂

0 Karma

Hi, simply put a sort command behind your search something like this:

... | sort column_name

you can control desc order with a minus:

... | sort -column_name

Revered Legend
0 Karma

Engager

Thank you. Exactly what I needed.
One column ranked by priority (Asc), the other by the length of the event (desc)

0 Karma

New Member

Actually, I want to sort the columns of column chart by value, I don't know if it's possible or not

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!