Splunk Search

Sort column headers in timechart - customize

martin86
Engager

Hi,

I would like to ask you, of there is some possibility order column based on requirement.

Case:

 

<search>
|eval lower_raw = lower(_raw) 
|rex field=lower_raw "^.*d=(?<opentask>[0-9]+).*" 
|rex field=lower_raw "^.*pm\s(?<trace>[0-9a-z-]+).*" 
|rex field=lower_raw "^.*taskid=(?<opentask>[0-9]+).*" 
|rex field=lower_raw "^.*uuid=(?<trace>[0-9a-z-]+).*" 
| eval task=opentask ."_".trace 
| transaction task
| eval timedelay=case(duration>=0 AND duration<2,"1 sec",duration>=2 AND duration<6,"2-5 sec",duration>=6 AND duration<11,"6-10 sec",duration>=11,"11 and more sec",1=1,"error") 
| timechart span=10m count avg(duration) as avg  by timedelay 
| sort by _time timedelay desc

 

 

I would like to have sorted by group (count event) and AVG duration

I mean, first column time (ok now)

second will be "count: 1sec"

third: "avg: 1sec"

forth: "count: 2-5sec"

fifth: "avg: 2-5sec"

 

etc.

Current it looks like this

martin86_0-1625218824624.png

which is not nice

expectation:

martin86_1-1625219055254.png

 

Thank you

Labels (2)
Tags (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@martin86 

I suggest to use table command to rearrange the columns.

Like

| timechart span=10m count avg(duration) as avg  by timedelay 
| sort by _time timedelay desc
|table LIST OF COLUMNS YOU NEED

 

KV 

View solution in original post

0 Karma

martin86
Engager

@kamlesh_vaghela

Thank you, it works

martin86_0-1625223659578.png

 

 

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@martin86 

I suggest to use table command to rearrange the columns.

Like

| timechart span=10m count avg(duration) as avg  by timedelay 
| sort by _time timedelay desc
|table LIST OF COLUMNS YOU NEED

 

KV 

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...