Splunk Search

Sort X axis based on the value of legends?

Kirthika
Path Finder

I want X axis to be follow the same way as legend order. 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You have 3 things in the chart: the x-axis; the y-axis; and, the series. The legend applies to the series not the axis.

Please share your SPL and clarify what you want the legend to show

0 Karma

Kirthika
Path Finder

Sort x axis

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The legend is in the order of the series in the table. Chart tries to be helpful by putting these in a sorted order. In order to work against this, you have to do a couple of tricks. Try this:

| chart count(Device_ID) over latestversion by Final useother=f
| untable latestversion Final count
| where count > 0
| eval Final=latestversion."!".Final
| xyseries latestversion Final count
| transpose 0 column_name=Final header_field=latestversion
| eval Final=mvindex(split(Final,"!"),1)
| transpose 0 column_name=latestversion header_field=Final
0 Karma

Kirthika
Path Finder

Thanks. But now legend values not in sorted order.  It is 2020, 2021, 2020 etc..But we need 2020 2020 2021.

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| chart count(Device_ID) over latestversion by Final useother=f
| untable latestversion Final count
| where count > 0
| eval latestversion=Final."!".latestversion
| xyseries latestversion Final count
| eval latestversion=mvindex(split(latestversion,"!"),1)
0 Karma

Kirthika
Path Finder

Thank you. It is working perfectly

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...