Splunk Search

how to add labels to chart values or order timechart

0range
Communicator

Hello.
My query looks like
...| timechart count by type
And I have values tupe_a, type_b and so on. When I call them like
eval name=case(type=type_a, "Error", type=type_b, "OK")...
and use "count by name" the rows in my staced timechart are ordered by name. But I need it to order by summary count. When I use "count by type" , they are ordered by summary count. How to specify the order or rename the types on the final chart?

Tags (3)
0 Karma

linu1988
Champion

Using timechart it's not possible as the values sorted will be distorting the time in the chart. Better use the stats function and do the calculation after the eval. Then apply the sort function. Thanks.

0 Karma

HiroshiSatoh
Champion

If you just add a total row

…|addcoltotals labelfield=name label=ALL

name count
Error 10
OK 100
ALL 110

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...