Dashboards & Visualizations

Adjusting the x-axis on chart count

dannyzen
Explorer

I'm using | chart count over severity by technique to display events by level of severity
Currently I am not getting severity in order from Highest to Lowest on the x-axis where the order is off in the column chart visualization
I've also tried
| stats count by severity technique

What would be an effective way to have these order correctly?
Thanks in advance!

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

index=_* sourcetype!=audittrail
| stats count BY log_level
| eval _log_level = case(
   log_level=="INFO", 0,
   log_level=="WARN", 1,
   log_level=="ERROR", 2,
   log_level=="MAJOR", 3,
   log_level=="MINOR", 4,
   log_level=="CRITICAL", 5)
| sort 0 _log_level

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

index=_* sourcetype!=audittrail
| stats count BY log_level
| eval _log_level = case(
   log_level=="INFO", 0,
   log_level=="WARN", 1,
   log_level=="ERROR", 2,
   log_level=="MAJOR", 3,
   log_level=="MINOR", 4,
   log_level=="CRITICAL", 5)
| sort 0 _log_level
0 Karma

dannyzen
Explorer

Thank you! this is great

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...