Hello,
I have a report with a stacked bar chart I would like to sort by "length", ie. by the total number of events in a bar. The search is
... | chart count over N_vendor by N_subnetname
and I get the following graph.
I would like to get the graph sorted so that the largest bars (java, redhat, ... in the graph) are up.
Thanks!
Hi Wsw70,
So I got curious... try this:
<base search>
| chart count over N_vendor by N_subnetname
| addtotals fieldname=total
| sort -total
| fields - total
There's probably a more elegant way to do that, but it does the trick 🙂
Hi Wsw70,
So I got curious... try this:
<base search>
| chart count over N_vendor by N_subnetname
| addtotals fieldname=total
| sort -total
| fields - total
There's probably a more elegant way to do that, but it does the trick 🙂
Thanks - it works perfectly. I have another question regarding picking up the top 5 + what remains but I will put that in another question