Hello,
I'm trying to display a graph of the my Splunk applications by usage, highest to lowest within a given time period. Can I sort so I can see highest on the left to lowest over say 7 days. This is what I have now:
index=_internal source=*access.log GET sourcetype=splunk_web_access
| search "/app/"
| rex field=_raw "\/app\/(?\S+)\/"
| timechart span=1d count by appName usenull=f useother=f
| fields - launcher, search
I tried sorting by appName, count etc but no change.
here is what the current timechart looks like:
... View more