...imechart, for some reason the timechart looks completly different when I sort the fields befor. this is the basic search and it's results: |tstats count WHERE case=test responseCode=200 r...
I would like to visualize using the Single Value visualization with and Trellis Layout and sort panels by the value of the latest field in the BY clause. I can follow the timechart with a t...
...ssue is in the output the month field is not chronologically sorted instead it is alphabetical. I intend to sort it chronologically. I tried with the below query as well to achieve the desired output b...
Hello,
thank you in advance for your feedback.
I would like to sort the date so that my graph is coherent, can you please help me?
| tstats summariesonly=t allow_old_summaries=t c...
...tem\":\"disk2\", \"size\":1099511627776, \"size_pretty\":\"1 TB\"}]"
| table item size size_pretty Now when you sort by "size" the table works as expected (2GB is smaller than 1TB). W...
I am currently using a bar chart visualization but I need to sort the bars by descending order. I can't use a simple chart count by EVNTSEVCAT | sort -count because the SEVCAT f...
Dear All, Kindly suggest , How to sort data in stats command output as per event time . Example: Requirement : VPN login details as per source user In last one hour. SPL Query : i...
...licked on the Time header in the table, the column is still not sorted. I am wondering if anyone can shed some light on this? Thank you!
| bucket _time span=60m | eval Time=strftime(_time, "%m/%d %H...
I was surprised by this result: In a field starting with a value that can be interpreted as an integer, groupby treats it lexically, but sort treats it numerically. How does sort determine t...
Hello, I don't know how to simulate this using makeresults, but I have data over 10,000 (let say 50,000) If I sort descending using "| sort - 0 Score", it will only give me 10,000 rows, but I u...