I have a column chart and want to order the columns. The above link isn't quite what I am looking for. My search query is as follows, and works all apart from I'd like it ordering.
host="*90*" FeedSource | search Fixture>0 | stats max(_time) As LatestTime By Action | eval Gap=time()-LatestTime | chart last(Gap) by Action`
How can I order the fields such as CACHEINSERT CACHEUPDATE etc?
Many thanks in advance.
I am not sure this will work, but try putting the table command at the end of your search, listing the fields in the order that you want them to appear. Be sure to list them all!
host="*90*" FeedSource Fixture>0 | stats max(_time) As LatestTime By Action | eval Gap=time()-LatestTime | chart last(Gap) as lastGap by Action | table CACHE_INSERT CACHE_UPDATE
I do see some problems with this. First
time() is the current wall clock time - even if you want the "current" time, I would use
now() is when the search began, and so it will be consistent for all events in this search. But
time() will vary based on how long this search takes to run.
The second problem is that your table command must list all the values of Action. If these change, then your search must be updated.
Thanks, seems to have had the same effect as in the link I posted in my question. Also using now() in a real-time search causes the results to gradually move into greater negative values.