Sort for chart not working

[JeremyHagan]

Hi,
I'm doing a search on the _internal index for license usage by host. I'd like the histogram to have the biggest values of X by Y on the left and I've been searching here for half an hour and it seems that what I am trying to do should be working, but it isn't.
Can anyone point out the issue?

Here is my search:
index=_internal source=*license_usage.log type=Usage | eval MB = round(b/1024/1024,1) | chart sum(MB) as MegaBytes by h | rename h as device | sort –MegaBytes

[pavankumarh · Accepted solution]

i copy pasted your query and it didn't sort. i just deleted the "-" character before MegaBytes and typed it again.
the search query gave me sorted results. Strange Though.

index=_internal source=*license_usage.log type=Usage | eval MB = round(b/1024/1024,1) | chart sum(MB) as MegaBytes by h | rename h as device | sort -MegaBytes

[gokadroid]

Hi Pavan,
In the answer I gave I mentioned how will it sort with - sign. Please try that.

[gokadroid]

@JeremyHagan - So which answer is acceptable. this one on which I commented or the one I actually answered 🙂 which is down below

[JeremyHagan]

Pavan's response was correct. gokadroid was not.

[JeremyHagan]

You are correct. Turns out an en-dash crept into my search.

PS C:\> [int][char]'–'
8211
PS C:\> [int][char]'-'
45

[hunters_splunk]

Hi Jeremy,

Aside from creating your own search query, you can also view license usage information in DMC:

1. In Splunk Web, select Settings from the menu and click Monitoring Console.
2. From the DMC menu, select Indexing > License Usage > License Usage - Previous 30 days to view license usage statistics and charts in the past month.
   

Hope it helps. Thanks!
Hunter

[gokadroid]

Minus sign is too close to MegaBytes.
Can you try this

|sort - MegaBytes

Adding complete query if above was not self explanatory:

index=_internal source=*license_usage.log type=Usage | eval MB = round(b/1024/1024,1) | chart sum(MB) as MegaBytes by h | rename h as device | sort – MegaBytes

[vikashforsrm]

Minus sign with space in between seems to work!

[JeremyHagan]

Actually that is wrong. It turns out an en-dash managed to creep into my search from copy/paste. You don't need a space between the minus and the sort field.

[gokadroid]

But to have the biggest histogram bar on the left most (which was your question) you have to sort it with en-dash(minus) else the requirement of the question is not fulfilled whether u have the space or not. So kind of get what u r saying..

I quote like you stated
Id like the histogram to have the biggest values of X by Y on the left "

[JeremyHagan]

"minus sign too close to MegaBytes" is not the answer. No space is required between the minus and the sort field. It works with or without the space between the minus and the sort field.