Splunk Search

Sort stacked bar chart columns based on a value

D_D
Explorer

Hello,

I'm struggling with sorting bar chart columns based on a time value.

I have the following in my search:

 

 

 

| chart last(duration) as duration over run_id by task_id

 

 

 


and I get the following table:

 

 

 

 

run_id	task_1		 task_2	 	task_3	 	task_4		 
1	14.55000000	1.60000000	11.55000000	1.78333333
2	13.93333333	2.73333333	13.55000000	1.91666667

 

 

in the stacked chart visualization the tasks are showing from top to bottom in the order of the tasks column (first task_1 then task_2, etc).

i want to sort the task_id colums based on a value (start time) which i have on the initial search (pre charting) for each of the tasks.

is it possible to do that?

Thank you!

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try replacing the chart command with this

| eval _time = starttime
| timechart last(duration) as duration by task_id

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

D_D
Explorer

Hi,

 

appreciate your assistance,

when i change to your suggestion there is two issues:

1) The columns are still not sorted by starttime field.

2) The x-axis is now by time and not by task_id.

 

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

What x-axis?  The original question had a table, not a graph, so why is there now a graph?

Let's start over.  Please describe at length what data you have and what you would like the result of a query to look like.  Explain any transformations necessary.

---
If this reply helps you, Karma would be appreciated.
0 Karma

D_D
Explorer

Hi,

Okay, so here is the raw data by fields:

 

run_id:
task_name:
starttime:
finishtime:

 

 
I want to create a stack bar chart where in each bar i can see all the task_name fields for all run_id, and for each task_name i want to see his duration (calculated by finishtime-startime).

i achieved that by getting the following table and displaying in as a bar chart:

 

run_id	task_1		 task_2	 	task_3	 	task_4		 
1	14.55000000	1.60000000	11.55000000	1.78333333
2	13.93333333	2.73333333	13.55000000	1.91666667

 


on the current display, each bar contains 4 tasks by the order of them is (task_1 on the top, then task_2 bellow him and on the bottom there is task_4)

 

 

current bar char stacked:
----------------
|              | <- task_1
|              | <- task_2
|              | <- task_3
|              | <- task_4

 



i want to rearrange that order by each task starttime (do task with the lowest start time should be at the bottom), so i believe i can do that by rearrange the columns.


 

bar char stacked i want to have:
---------------
|              | <- task with highest start time
|              | <- task_2
|              | <- task_3
|              | <- task with lowest start time

 


But i still want the chart bar to be have x axis (run_in), y-axis(duration, using axis might be the wrong word, but i want duration over/by task_id for the chart display.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...

span_metrics: The OpenTelemetry-Idiomatic Way to See Inside Your Services

You open a trace in Splunk Observability Cloud and everything looks fine. One root span, order-pipeline, with ...