Splunk Search

Sort X axis based on the value of legends?

Kirthika
Path Finder

I want X axis to be follow the same way as legend order. 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You have 3 things in the chart: the x-axis; the y-axis; and, the series. The legend applies to the series not the axis.

Please share your SPL and clarify what you want the legend to show

0 Karma

Kirthika
Path Finder

Sort x axis

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The legend is in the order of the series in the table. Chart tries to be helpful by putting these in a sorted order. In order to work against this, you have to do a couple of tricks. Try this:

| chart count(Device_ID) over latestversion by Final useother=f
| untable latestversion Final count
| where count > 0
| eval Final=latestversion."!".Final
| xyseries latestversion Final count
| transpose 0 column_name=Final header_field=latestversion
| eval Final=mvindex(split(Final,"!"),1)
| transpose 0 column_name=latestversion header_field=Final
0 Karma

Kirthika
Path Finder

Thanks. But now legend values not in sorted order.  It is 2020, 2021, 2020 etc..But we need 2020 2020 2021.

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| chart count(Device_ID) over latestversion by Final useother=f
| untable latestversion Final count
| where count > 0
| eval latestversion=Final."!".latestversion
| xyseries latestversion Final count
| eval latestversion=mvindex(split(latestversion,"!"),1)
0 Karma

Kirthika
Path Finder

Thank you. It is working perfectly

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...