Splunk Search
Highlighted

Sort for chart not working

Communicator

Hi,
I'm doing a search on the _internal index for license usage by host. I'd like the histogram to have the biggest values of X by Y on the left and I've been searching here for half an hour and it seems that what I am trying to do should be working, but it isn't.
Can anyone point out the issue?

Here is my search:
index=_internal source=*license_usage.log type=Usage | eval MB = round(b/1024/1024,1) | chart sum(MB) as MegaBytes by h | rename h as device | sort –MegaBytes

Highlighted

Re: Sort for chart not working

Motivator

Minus sign is too close to MegaBytes.
Can you try this


|sort - MegaBytes

Adding complete query if above was not self explanatory:


index=internal source=*licenseusage.log type=Usage | eval MB = round(b/1024/1024,1) | chart sum(MB) as MegaBytes by h | rename h as device | sort – MegaBytes

Highlighted

Re: Sort for chart not working

Engager

Minus sign with space in between seems to work!

0 Karma
Highlighted

Re: Sort for chart not working

Communicator

Actually that is wrong. It turns out an en-dash managed to creep into my search from copy/paste. You don't need a space between the minus and the sort field.

0 Karma
Highlighted

Re: Sort for chart not working

Motivator

But to have the biggest histogram bar on the left most (which was your question) you have to sort it with en-dash(minus) else the requirement of the question is not fulfilled whether u have the space or not. So kind of get what u r saying..

I quote like you stated
Id like the histogram to have the biggest values of X by Y on the left "

0 Karma
Highlighted

Re: Sort for chart not working

Communicator

"minus sign too close to MegaBytes" is not the answer. No space is required between the minus and the sort field. It works with or without the space between the minus and the sort field.

0 Karma
Highlighted

Re: Sort for chart not working

Splunk Employee
Splunk Employee

Hi Jeremy,

Aside from creating your own search query, you can also view license usage information in DMC:

  1. In Splunk Web, select Settings from the menu and click Monitoring Console.
  2. From the DMC menu, select Indexing > License Usage > License Usage - Previous 30 days to view license usage statistics and charts in the past month.

Hope it helps. Thanks!
Hunter

Highlighted

Re: Sort for chart not working

Explorer

i copy pasted your query and it didn't sort. i just deleted the "-" character before MegaBytes and typed it again.
the search query gave me sorted results. Strange Though.

index=internal source=*licenseusage.log type=Usage | eval MB = round(b/1024/1024,1) | chart sum(MB) as MegaBytes by h | rename h as device | sort -MegaBytes

View solution in original post

Highlighted

Re: Sort for chart not working

Motivator

Hi Pavan,
In the answer I gave I mentioned how will it sort with - sign. Please try that.

0 Karma
Highlighted

Re: Sort for chart not working

Communicator

You are correct. Turns out an en-dash crept into my search.

PS C:\> [int][char]'–'
8211
PS C:\> [int][char]'-'
45
0 Karma