Splunk Search

Sort the legend's display from chart

BDAS
Explorer

Hi everyone!

I would like to display several areas (stacked) or columns in a specific order. Here is my charting command :

| chart avg(countUsers) as avgCountUsers over Time by ID

My IDs are like 1001, 1002, 1003 ... 2001, 2002 ...

For example, the average corresponding to 1001 is above 1002, which is above 1003, and I want to reverse the areas/columns so that I display 1001 first, then 1002 on top of it, etc.

I tried the sort command and the reverse one, but my chart remained the same, maybe I haven't used it correctly.

Any ideas?

Thanks in advance!

BlueLychee.

Tags (1)

uksysadmins
New Member

Looks like the chart module just creates the legend entry when it gets an entry so you just need to sort by ID prior to piping it the chart.

| sort ID | chart avg(countUsers) as avgCountUsers over Time by ID

0 Karma

nugetchar
Explorer

I don't really understand... Don't you just have to write something like that?
==> "| fields 1003, 1002, 1001"

Unless you cannot know in advance how many results you will have... For example "1001 1002 1003" and later "2001 2002 2003 2004 2005"... In this case (and know I assume that this is your situation), I don't know how to do...

nugetchar

BDAS
Explorer

Thanks for answering so fast!

Yes, it works fine with | fields 1003 1002 1001 but I want my search to be generic in case I would receive other IDs (ex: 4001, 4002 ...)

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...