Splunk Search

Splunk Chart dynamic column header sorting

avadhutha
Explorer

I have a chart formed like below and it's dynamic columns are created based on processes date. By default now the column header sort is happing from lower to higher value but I am looking in a format where headers of processDates are higher to lower.

Query:

|chart latest(Count) as Count by Name ,ProcessDate

Current Output:

Name   20240101 20240102 20240103
xyzNANANA
123NANANANA

 

 

Expecting output:

Name   2024010320240102 20240101
xyzNANANA
123NANANANA

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| transpose 0 column_name=Date header_field=Name
| sort 0 -Date
| transpose 0 column_name=Name header_field=Date

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| transpose 0 column_name=Date header_field=Name
| sort 0 -Date
| transpose 0 column_name=Name header_field=Date

avadhutha
Explorer

Thank you mate for the help,  Below corrected one helped with faster results.

 

|chart latest(Count) as Count by ProcessDate,Name
|sort 0 - ProcessDate
| transpose 0 column_name=Name header_field=ProcDate

 

 

 

0 Karma

dural_yyz
Motivator

Try

| chart latest(Count) as Count by Name, ProcessDate
| sort ProcessDate desc

Found a very similar request under this previously answered question.

https://community.splunk.com/t5/Splunk-Search/How-to-display-column-results-in-descending-order/m-p/...

0 Karma

avadhutha
Explorer

No, it is not working

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...