Splunk Search

Sort stacked bar chart columns based on a value

D_D
Explorer

Hello,

I'm struggling with sorting bar chart columns based on a time value.

I have the following in my search:

 

 

 

| chart last(duration) as duration over run_id by task_id

 

 

 


and I get the following table:

 

 

 

 

run_id	task_1		 task_2	 	task_3	 	task_4		 
1	14.55000000	1.60000000	11.55000000	1.78333333
2	13.93333333	2.73333333	13.55000000	1.91666667

 

 

in the stacked chart visualization the tasks are showing from top to bottom in the order of the tasks column (first task_1 then task_2, etc).

i want to sort the task_id colums based on a value (start time) which i have on the initial search (pre charting) for each of the tasks.

is it possible to do that?

Thank you!

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try replacing the chart command with this

| eval _time = starttime
| timechart last(duration) as duration by task_id

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

D_D
Explorer

Hi,

 

appreciate your assistance,

when i change to your suggestion there is two issues:

1) The columns are still not sorted by starttime field.

2) The x-axis is now by time and not by task_id.

 

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

What x-axis?  The original question had a table, not a graph, so why is there now a graph?

Let's start over.  Please describe at length what data you have and what you would like the result of a query to look like.  Explain any transformations necessary.

---
If this reply helps you, Karma would be appreciated.
0 Karma

D_D
Explorer

Hi,

Okay, so here is the raw data by fields:

 

run_id:
task_name:
starttime:
finishtime:

 

 
I want to create a stack bar chart where in each bar i can see all the task_name fields for all run_id, and for each task_name i want to see his duration (calculated by finishtime-startime).

i achieved that by getting the following table and displaying in as a bar chart:

 

run_id	task_1		 task_2	 	task_3	 	task_4		 
1	14.55000000	1.60000000	11.55000000	1.78333333
2	13.93333333	2.73333333	13.55000000	1.91666667

 


on the current display, each bar contains 4 tasks by the order of them is (task_1 on the top, then task_2 bellow him and on the bottom there is task_4)

 

 

current bar char stacked:
----------------
|              | <- task_1
|              | <- task_2
|              | <- task_3
|              | <- task_4

 



i want to rearrange that order by each task starttime (do task with the lowest start time should be at the bottom), so i believe i can do that by rearrange the columns.


 

bar char stacked i want to have:
---------------
|              | <- task with highest start time
|              | <- task_2
|              | <- task_3
|              | <- task with lowest start time

 


But i still want the chart bar to be have x axis (run_in), y-axis(duration, using axis might be the wrong word, but i want duration over/by task_id for the chart display.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...