Hello,
We have the following chart which displays current ticket counts over the last 7 days for different groups but need to be able to sort on the count for the last day. In this case we would need to sort on Jul 30 but it would need to be dynamic and always sort on the most recent date in the chart. Here is the search we have:
index=reporter | dedup TKT_NUMBER | eval time=strptime(LASTOCCURRENCE, "%b %d %Y %I:%M%p") | bucket time span=1d | convert timeformat="%b %d" ctime("time") | chart count by NOTIFY_GROUP, time | rename NOTIFY_GROUP AS Group
Is this possible?
This is tricky because of the dynamic nature of your field. Here is one easy way to change this but there is a beautification aspect to note. Notice how you've lost the precision on your field names as those have now become part of the table itself.
Assuming that you consistently have ten (10) rows in your table and seven (7) columns, this will create the desired effect:
| transpose 10 | transpose 10 | fields - column | sort - "row 7"
This will change the format of your original table, like the one above, to something like this:
The other side effect is that by using the transpose command you've lost the ability to drill down.
[07-31-2130] Update:
While thinking about this, it occurred to me that renaming the last field is simple as long as it is understood that the dynamic "time" variable that you have is actually a list.
The key here is to perform a comparison between the value of the "time" list and the "today" list. If the comparison fits, then we should assign the value of the latest ("today") variable to the appropriate value in the "time" list.
The comparison I used was all using the ephoc date. It is just easier for me to deal with numeric values, rather than strings
| eval time=if(round((today-time)/60/60/24)=0,"Today",time)
Then we convert to the string desired:
| eval time=if(time="Today",time,strftime(time, "%b %d"))
And, finally, you can apply the chart transformation and sort:
| chart count over NOTIFY_GROUP by time
| rename NOTIFY_GROUP AS Group
| sort - Today
This will not change your format and it will keep click precision.
