how to sort a stacked bar chart by "length"

[wsw70]

Hello,

I have a report with a stacked bar chart I would like to sort by "length", ie. by the total number of events in a bar. The search is

... | chart count over N_vendor by N_subnetname 

and I get the following graph.

I would like to get the graph sorted so that the largest bars (java, redhat, ... in the graph) are up.

Thanks!

[rturk · Accepted solution]

Hi Wsw70,

So I got curious... try this:

<base search> 
| chart count over N_vendor by N_subnetname 
| addtotals fieldname=total 
| sort -total 
| fields - total

There's probably a more elegant way to do that, but it does the trick 🙂

[wsw70]

Thanks - it works perfectly. I have another question regarding picking up the top 5 + what remains but I will put that in another question