Splunk Search

Sort stacked bar chart columns based on a value

D_D
Explorer

Hello,

I'm struggling with sorting bar chart columns based on a time value.

I have the following in my search:

 

 

 

| chart last(duration) as duration over run_id by task_id

 

 

 


and I get the following table:

 

 

 

 

run_id	task_1		 task_2	 	task_3	 	task_4		 
1	14.55000000	1.60000000	11.55000000	1.78333333
2	13.93333333	2.73333333	13.55000000	1.91666667

 

 

in the stacked chart visualization the tasks are showing from top to bottom in the order of the tasks column (first task_1 then task_2, etc).

i want to sort the task_id colums based on a value (start time) which i have on the initial search (pre charting) for each of the tasks.

is it possible to do that?

Thank you!

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try replacing the chart command with this

| eval _time = starttime
| timechart last(duration) as duration by task_id

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

D_D
Explorer

Hi,

 

appreciate your assistance,

when i change to your suggestion there is two issues:

1) The columns are still not sorted by starttime field.

2) The x-axis is now by time and not by task_id.

 

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

What x-axis?  The original question had a table, not a graph, so why is there now a graph?

Let's start over.  Please describe at length what data you have and what you would like the result of a query to look like.  Explain any transformations necessary.

---
If this reply helps you, Karma would be appreciated.
0 Karma

D_D
Explorer

Hi,

Okay, so here is the raw data by fields:

 

run_id:
task_name:
starttime:
finishtime:

 

 
I want to create a stack bar chart where in each bar i can see all the task_name fields for all run_id, and for each task_name i want to see his duration (calculated by finishtime-startime).

i achieved that by getting the following table and displaying in as a bar chart:

 

run_id	task_1		 task_2	 	task_3	 	task_4		 
1	14.55000000	1.60000000	11.55000000	1.78333333
2	13.93333333	2.73333333	13.55000000	1.91666667

 


on the current display, each bar contains 4 tasks by the order of them is (task_1 on the top, then task_2 bellow him and on the bottom there is task_4)

 

 

current bar char stacked:
----------------
|              | <- task_1
|              | <- task_2
|              | <- task_3
|              | <- task_4

 



i want to rearrange that order by each task starttime (do task with the lowest start time should be at the bottom), so i believe i can do that by rearrange the columns.


 

bar char stacked i want to have:
---------------
|              | <- task with highest start time
|              | <- task_2
|              | <- task_3
|              | <- task with lowest start time

 


But i still want the chart bar to be have x axis (run_in), y-axis(duration, using axis might be the wrong word, but i want duration over/by task_id for the chart display.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...