Hello,
I am trying to chart some response time and wanted to use the log span as:
index=myIndex "time_value" | chart count by time_ms bins=100 span=2log5
My concern is that Splunk seems to be doing some alphabetical sorting which mixes my span ranges
for example it shows the span in the order of :
0 10-50 1250-6250 250-1250
while I would expect:
0 10-50 250-1250 1250-6250
Thanks for any help.
Stephane
You can fix this after the fact, like this:
| rename 0 AS " 0" "10-50" AS " 10-50" "250-1250" AS " 250-1250"
Note that 0
has been renamed with 3 leading spaces and 10-50
with just two (and so on until 1250-6250
is not renamed at all, so it has 0 spaces).
The whitespace is invisible in the chart but forces the alphabetical order that you desire.
You can fix this after the fact, like this:
| rename 0 AS " 0" "10-50" AS " 10-50" "250-1250" AS " 250-1250"
Note that 0
has been renamed with 3 leading spaces and 10-50
with just two (and so on until 1250-6250
is not renamed at all, so it has 0 spaces).
The whitespace is invisible in the chart but forces the alphabetical order that you desire.
thanks for the proposal, unfortunately that does not seem to work for me as the names are not getting changed with that process. I guess the chart is done before the rename and rename gets no effect. Looking at the splunk sample, http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Chart#9:_Chart_the_average_number_... I am getting a different result as the statistics data are not sorted on my side on my example, so I guess I may have some configuration issue or an invalid release.
If you are running a fileds
or table
command, the fields may be re-sorted. Try stripping off the commands after the chart command to see where the resorting happens and see if you can use a different command or perhaps that command has a keepcolorder
option (some commands do).
Thanks for the feedback.
unfortunately no. My request is just an index search piped to a chart count by MyCounter span=2log5.
My graph is strangely sorted as well as my statistics as if it is doing alphabetical sorting instead of looking at the ranges.
But that drove me to thinking that I should force the sorting, so adding sort MyCounter that made the trick.
Thanks again.
So what exactly was your final search?
My final search is:
index=myIndex "time_value" | chart count by time_ms bins=100 span=2log5 | sort time_ms bins
You need sort 0
, not just sort
.
Thanks for the feedback, strangely in my case the sort with the value is enough.