Splunk Search

Sorting the data values in a stacked timechart

adrianblakey
New Member

How do I order the horizontal slices in a stacked timechart by value?

The working search string looks like this:

timechart count by author.name limit=0

The data is coming from git commit records. Each record is labelled by author.name. The search string tallies the count of records for every author over a year and produces a nice stacked bar chart, one bar per month with every user's count stacked up in the bar.

However the stack is ordered alphabetically by author.name. How do I order it by count, lowest to highest top to bottom?

0 Karma

FrankVl
Ultra Champion

I wouldn't know of any way to do that. Generically you can manipulate the field value that you are counting by (the author.name in your case) with for instance a numerical prefix, to control the order in which things are shown in the graph.

And there might be a way to have splunk figure out the order of authors by count and number the author.names accordingly. The trouble is that you want to do this over time. So today one author has the highest count, tomorrow it's another. And that is not really something you can deal with by just adding some order prefix to the author.name.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...