Splunk Search

How to re-arrange a bar chart

jhoang
Path Finder

Hi,

I would like to sort my bar chart's by the following sequence, (Intensive, Intermediate, Minimal, Moderate). However it is currently being sorted alphabetically (Intensive, Intermediate, Minimal, Moderate.)

Below is my current search function:

index="sdp" Level !="Not Assigned" Urgency="*" | chart count over Level by Urgency | eval Level=if(Level="Intensive", "1. Intensive", if(Level="Intermediate","2. Intermediate", if(Level="Moderate","3. Moderate", if(Level="Minimal", "4. Minimal"

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

Put the eval before the chart, like this

index="sdp" Level !="Not Assigned" Urgency="*" 
| eval Level=if(Level="Intensive", "1. Intensive", 
             if(Level="Intermediate","2. Intermediate", 
              if(Level="Moderate","3. Moderate",
            if(Level="Minimal", "4. Minimal"))))
| chart count by Level Urgency 

View solution in original post

0 Karma

somesoni2
Revered Legend

I don't see any difference in your expected and current sort order. Do you expect Intensive, Intermediate, Moderate, Minimal as final sorting??? If yes, then @Iguinn's answer will give you correct sort order, after you update the expected sequence in that.

0 Karma

jhoang
Path Finder

Yea, that is correct, but when I ran Inguinn query, I received error message (Error in 'eval' command: The arguments to the 'if' function are invalid.)

0 Karma

chimell
Motivator

Hi
try this search code

index="sdp" Level !="Not Assigned" Urgency="*" | chart count over Level by Urgency | eval Level=case(Level=="Intensive", "1. Intensive", Level=="Intermediate","2. Intermediate", Level=="Moderate","3. Moderate", Level=="Minimal", "4. Minimal")
0 Karma

jhoang
Path Finder

Hi Chimell,

The above query added the values to the different urgency (1,2,3,4) but it is still being arranged in :

1)intensive
2) intermediate
4) Minimal
3) moderate

0 Karma

jhoang
Path Finder

Hi Chimell,

Any update on this?

0 Karma

lguinn2
Legend

Put the eval before the chart, like this

index="sdp" Level !="Not Assigned" Urgency="*" 
| eval Level=if(Level="Intensive", "1. Intensive", 
             if(Level="Intermediate","2. Intermediate", 
              if(Level="Moderate","3. Moderate",
            if(Level="Minimal", "4. Minimal"))))
| chart count by Level Urgency 
0 Karma

jhoang
Path Finder

Hi Iguinn,

Another agent is helping me on this item, thank you.

0 Karma

somesoni2
Revered Legend

Here is same query with case instead of if.

index="sdp" Level !="Not Assigned" Urgency="*"  | eval Level=case(Level="Intensive", "1. Intensive", Level="Intermediate","2. Intermediate",Level="Moderate","3. Moderate", Level="Minimal", "4. Minimal", 1=1, "5. Not defined") | chart count by Level Urgency 

Make sure the numbering is as per your need.

0 Karma

jhoang
Path Finder

it worked!!!! Thank you Somesoni2!!!

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...