Is it possible to customize the order of fields in the legend for a stacked column chart?

[splunkrocks2014]

Hi. I have a stacked column chart with stacked. The end of the search is the following:

 | chart count over fields by status

I think by default, the legend is displayed by alphabetical order based on the status name. Is it possible to customize the order? For instance, I have status with a,b,c,d,and e, can I sort the order as a, c, e, d, b?

Thanks.

[Kenshiro70]

Use the fields command, like so:

| chart count over serverType by status
| fields serverType a c e d b

(I changed the name from "fields" in the original example to "serverType" to avoid confusion.)

Note that depending on the result set, you might need to use transpose or xyseries to move the data fields into columns.

[woodcock]

Yes, you need to prepend the appropriate number of spaces to each so that the names will be alphabetically in the order that you desire. When splunk renders the names of each, the spaces will be invisible. So in your case, like this:

| chart count over fields by status | rename a AS "    a" c AS "   c" e AS "  e" d AS " d"

[jkat54]

Sure. We typically achieve this with an eval if condition that affixes a number to the front like this.

| eval status=if(status=="a","1.a",if(status=="c","2.c","else"))

You could do this with if or case eval functions and you might need to combine it with the match eval function so you can match based on regex:

 | eval status=if(match(status,"[aA]"),"1.a",if(match(status,"[cC]"),"2.c","else"))

or like this but replacing {regex} with a regex that matches what you're looking for:

 | eval status=if(match(status,"{regex}"),"1.a",if(match(status,"{regex}"),"2.c","else"))

[jkat54]

Yep, only method without numbers or letters is custom JS or css or maybe both. Would only work for specific data and I'd only recommend it in narrow circumstances however.

[splunkrocks2014]

That works as expected, but the status name starts with a number. I guess that's impossible to remove the number.