@gcusello  I have a below Query- index="services" statusCode="500" | bucket _time span=day | eval time=strftime(_time,"%F") | chart count by customerId,time Result shown in below screenshot, and I want to sort by last column. Somehow I evaluated what would be column name with below eval function- | eval max="1900-01-01", reg="^\d{4}-\d{2}-\d{2}$" | foreach * [eval col="<<FIELD>>", max=if(match(col,reg), if(col>max,col,max) ,max)] | sort - max | fields - col max reg But in above query , sort -max is not working for me.   I'm just looking for a solution to sort this dynamically generated column through query. ... View more

@ITWhisperer , I want to do the sorting through Query as we need to use this chart in Dashboard. I wonder if Splunk even have this feature. ... View more

what if variable is holding the column_name and then I want to sort that column.  for example my_search | eval date="2023-02-02" | sort  - $date is it possible to sort by column name which is dynamically generated So i won't know the exact name But variable holds the column name So I can just use sort - $Variable? ... View more

Thanks @ITWhisperer , This Query is working for me. Now I'm facing a challenge to sort by specific column let say 3rd column. index="services" statusCode="500" | bucket _time span=day | eval time=strftime(_time,"%F") | chart count by customerId Since these date fields are dynamically getting generated and user can specify any date range So I can not specify | sort -"2023-02-09" . In this case how to sort by any specific column which is dynamically generated by bucket _time span?   ... View more