Splunk Search

Splunk Chart dynamic column header sorting

avadhutha
Explorer

I have a chart formed like below and it's dynamic columns are created based on processes date. By default now the column header sort is happing from lower to higher value but I am looking in a format where headers of processDates are higher to lower.

Query:

|chart latest(Count) as Count by Name ,ProcessDate

Current Output:

Name   20240101 20240102 20240103
xyzNANANA
123NANANANA

 

 

Expecting output:

Name   2024010320240102 20240101
xyzNANANA
123NANANANA

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| transpose 0 column_name=Date header_field=Name
| sort 0 -Date
| transpose 0 column_name=Name header_field=Date

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| transpose 0 column_name=Date header_field=Name
| sort 0 -Date
| transpose 0 column_name=Name header_field=Date

avadhutha
Explorer

Thank you mate for the help,  Below corrected one helped with faster results.

 

|chart latest(Count) as Count by ProcessDate,Name
|sort 0 - ProcessDate
| transpose 0 column_name=Name header_field=ProcDate

 

 

 

0 Karma

dural_yyz
Motivator

Try

| chart latest(Count) as Count by Name, ProcessDate
| sort ProcessDate desc

Found a very similar request under this previously answered question.

https://community.splunk.com/t5/Splunk-Search/How-to-display-column-results-in-descending-order/m-p/...

0 Karma

avadhutha
Explorer

No, it is not working

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...