Splunk Search

how to sort a stacked bar chart by "length"

wsw70
Communicator

Hello,

I have a report with a stacked bar chart I would like to sort by "length", ie. by the total number of events in a bar. The search is

... | chart count over N_vendor by N_subnetname 

and I get the following graph.

I would like to get the graph sorted so that the largest bars (java, redhat, ... in the graph) are up.

Thanks!

Tags (3)
1 Solution

rturk
Builder

Hi Wsw70,

So I got curious... try this:

<base search> 
| chart count over N_vendor by N_subnetname 
| addtotals fieldname=total 
| sort -total 
| fields - total

There's probably a more elegant way to do that, but it does the trick 🙂

View solution in original post

rturk
Builder

Hi Wsw70,

So I got curious... try this:

<base search> 
| chart count over N_vendor by N_subnetname 
| addtotals fieldname=total 
| sort -total 
| fields - total

There's probably a more elegant way to do that, but it does the trick 🙂

wsw70
Communicator

Thanks - it works perfectly. I have another question regarding picking up the top 5 + what remains but I will put that in another question

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...