Splunk Search

Sort the top header from lowest to highest?

MarsBar
Engager

Hey all,

Just started learning Splunk this week, interesting so far. How can I sort the top header from lowest to highest? Attached an example of what I'm working with below. Just want to organise it.
 image_2021-12-29_230331.png

Labels (3)

ITWhisperer
SplunkTrust
SplunkTrust
| gentimes start=-7 increment=10m 
| rename starttime as _time 
| eval hour=tonumber(strftime(_time,"%H"))
| eval x=random()%2
| bin _time span=1d
| stats sum(x) as x by _time hour
| eval x=if(x>3,true(),null())
| xyseries _time hour x
``` The lines above sets up some dummy data similar to the example ```

``` Transpose the chart table ```
| transpose 0 header_field=_time column_name=_time
``` Sort by the numeric field ```
| sort 0 _time
``` Transpose back to the original layout ```
| transpose 0 header_field=_time column_name=_time

MarsBar
Engager

Thank you! This worked. Do you know where I can learn on this type of topic?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Splunk documentation and Community posts are a good source, as are .conf, and BSides presentations and Splunk youtube channel. There are also a number of slack groups.

0 Karma

johnhuang
Motivator

Splunk will sort the column name as an ASCII string rather than a number. You can manipulate this behavior by making the hours as 2 digits, 00, 01, 02, etc, or padding single digits with a leading space.

In this case, the quick and dirty way is just manually specify the order:

| table _time 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

 

 

 

inventsekar
SplunkTrust
SplunkTrust

Hi @MarsBar Good to know your Splunk Journey so far.. 

Please update us your current Splunk Search Query, so that we can suggest you the sort task. 

 

in simple, you can assign the hour values to a variable and then sort it. 

the chart (and stats) got so many options for you/us to learn. 

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...