when you do the chart command | chart limit=0 max(duration) over cycle by step the order of rows will be in the order the the cycle column, which then influences the order of the columns in the chart. If this is not the order you want, then you will need to sort the results on the cycle column. That will then mean you need to ensure your cycle column can be sorted sensibly so that it will sort as you need. If that means you need to incorporate a _time element to the cycle name then you can do this | eval cycle=_time.":".cycle
| chart limit=0 max(duration) over cycle by step
| eval cycle=replace(cycle, "\d+:", "") which will add the time field as a prefix to the cycle field, so it's sorted in time order and then you just remove the time part afterwards
... View more