Sort the top header from lowest to highest?

[MarsBar]

Hey all,

Just started learning Splunk this week, interesting so far. How can I sort the top header from lowest to highest? Attached an example of what I'm working with below. Just want to organise it.
 

[ITWhisperer]

| gentimes start=-7 increment=10m 
| rename starttime as _time 
| eval hour=tonumber(strftime(_time,"%H"))
| eval x=random()%2
| bin _time span=1d
| stats sum(x) as x by _time hour
| eval x=if(x>3,true(),null())
| xyseries _time hour x
``` The lines above sets up some dummy data similar to the example ```

``` Transpose the chart table ```
| transpose 0 header_field=_time column_name=_time
``` Sort by the numeric field ```
| sort 0 _time
``` Transpose back to the original layout ```
| transpose 0 header_field=_time column_name=_time

[MarsBar]

Thank you! This worked. Do you know where I can learn on this type of topic?

[ITWhisperer]

Splunk documentation and Community posts are a good source, as are .conf, and BSides presentations and Splunk youtube channel. There are also a number of slack groups.

[johnhuang]

Splunk will sort the column name as an ASCII string rather than a number. You can manipulate this behavior by making the hours as 2 digits, 00, 01, 02, etc, or padding single digits with a leading space.

In this case, the quick and dirty way is just manually specify the order:

| table _time 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

[inventsekar]

Hi @MarsBar Good to know your Splunk Journey so far.. 

Please update us your current Splunk Search Query, so that we can suggest you the sort task. 

in simple, you can assign the hour values to a variable and then sort it. 

the chart (and stats) got so many options for you/us to learn.