Splunk Search

Sorting Charts

richnavis
Contributor

I have the following search that returns a chart of response times for web pages by GET and POST.

index=iis_PRODUCT | regex cs_method="(GET|POST)" | chart avg(time_taken) as response_time count(host) as hits by cs_uri_stem, cs_method | sort response_time

However, the sort command does not seem to work. Perhaps it's because the field names have the method appended to it? something like this.... hits:GET hits:POST. Not sure how to solve this.

Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You are indeed trying to sort by a column that does not exist at this time. I see two options:

First, you could pick one of the columns to sort by. Let's assume one of the response_time fields is called "response_time: GET":

search... | chart... | sort "response_time: GET"

Alternatively, if you cannot decide which response time field is the relevant one to search, you could summarize them into a helper field that then is used for sorting:

search... | chart... | addtotals fieldname=temp_sort response_time* | sort temp_sort

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You are indeed trying to sort by a column that does not exist at this time. I see two options:

First, you could pick one of the columns to sort by. Let's assume one of the response_time fields is called "response_time: GET":

search... | chart... | sort "response_time: GET"

Alternatively, if you cannot decide which response time field is the relevant one to search, you could summarize them into a helper field that then is used for sorting:

search... | chart... | addtotals fieldname=temp_sort response_time* | sort temp_sort

richnavis
Contributor

Very nice.. I think I will use the addtotals option. Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...