Splunk Search

Sort X axis based on the value of legends?

Kirthika
Path Finder

I want X axis to be follow the same way as legend order. 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You have 3 things in the chart: the x-axis; the y-axis; and, the series. The legend applies to the series not the axis.

Please share your SPL and clarify what you want the legend to show

0 Karma

Kirthika
Path Finder

Sort x axis

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The legend is in the order of the series in the table. Chart tries to be helpful by putting these in a sorted order. In order to work against this, you have to do a couple of tricks. Try this:

| chart count(Device_ID) over latestversion by Final useother=f
| untable latestversion Final count
| where count > 0
| eval Final=latestversion."!".Final
| xyseries latestversion Final count
| transpose 0 column_name=Final header_field=latestversion
| eval Final=mvindex(split(Final,"!"),1)
| transpose 0 column_name=latestversion header_field=Final
0 Karma

Kirthika
Path Finder

Thanks. But now legend values not in sorted order.  It is 2020, 2021, 2020 etc..But we need 2020 2020 2021.

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| chart count(Device_ID) over latestversion by Final useother=f
| untable latestversion Final count
| where count > 0
| eval latestversion=Final."!".latestversion
| xyseries latestversion Final count
| eval latestversion=mvindex(split(latestversion,"!"),1)
0 Karma

Kirthika
Path Finder

Thank you. It is working perfectly

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...