Hello,
I have a bar chart and it displays as
|
| |
| | |
a b c
While I would like to have
|
| |
| | |
b a c
ie. sorted by the value of the bar and not by its name. I searched for "order bar chart", "sort bar chart" but somehow I seem to be the only one having such metaphysical problems 🙂
Any ideas?
Thanks!
Hi wsw,
If you pipe your search to "| sort - Value" (or whatever the field is called), then graph it as a bar chart, it should sort automatically. Does this work for you?
Hi wsw,
If you pipe your search to "| sort - Value" (or whatever the field is called), then graph it as a bar chart, it should sort automatically. Does this work for you?
Well, a timechart is always going to show the same order of events on the x-axis because time doesn't change. Are you trying to order the bars within each time segment from largest to smallest?
It still doesn't seem to work:
(host, sourcetype, yada yada) | multikv fields PRODUCER HOST | timechart span=1d avg(TRANSFERS) as TRANSFERS by HOST | sort - TRANSFERS
You need to name the averaged field something. timechart span=1d avg(TRANSFERS) as TRANSFERS by HOST should work.
I take the average of a field called 'TRANSFERS' so for me my search is "timechart span=1d avg(TRANSFERS) by HOST"
If I add "| sort - TRANSFERS" it doesn't do anything differently.
Any ideas?