Splunk Search

Sorting Multivalue Stacked Bar Chart

aaronkorn
Splunk Employee
Splunk Employee

Anyone have an idea to sort a multivalued stacked bar chart based on the value? I already tried | sort -Size.

The search is: index=sccm Size>0 | chart avg(Size) by Directory, SiteCode

0 Karma

lguinn2
Legend

Okay, based on your post, I would run the search this way:

index=sccm Size>0 
| chart avg(Size) as AvgSize by SiteCode
| sort -AvgSize
0 Karma

aaronkorn
Splunk Employee
Splunk Employee

We are not applying a sum to the site code. The site code simply acts as an identifier for different sources of data. The point of this graph is to show the average directory size per SiteCode to notice size differences..

0 Karma

lguinn2
Legend

Hmm, if you want to add up the average sizes of the SiteCodes and sort by the total, you will need to know the values of the site codes. For my example, I will ensure that the values of the site codes all begin with "SiteCode:"

index=sccm Size>0 
| eval SiteCode = "SiteCode:" + SiteCode
| chart avg(Size) as AvgSize by Directory, SiteCode
| addtotals fieldname=TotalAvg SiteCode*
| sort -TotalAvg
| fields - TotalAvg

I may not really understand the question, though.

And I do question the statistical validity of any chart that sums (or stacks) averages...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...