Sorting timechart series

Have you tried this route?: timechart count by type | sort num(type)

(From: http://www.splunk.com/base/Documentation/latest/SearchReference/Sort )

1) If the numbers really are quite small it's probably best to just use the fields command to reorder them.

<your search> | fields _time 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

2) or you could look into the transpose command. You could in theory transpose, sort and then transepose again. However transpose has some strange characteristics and you'd have to use a lot of eval contortions to end up with what you want....

3) if the numbers are NOT small, you dont want to have a fields command that lists every integer, and you dont mind bucketing the split-by field a little, you can use this:

<your search> | timechart count by date_second bins=10

Not many people know this, but if you put a bins argument after a split-by term, it actually buckets the split-by term.... So you end up with column values like "10-20", "20-30", "30-40", "40-50" etc... This may not be what you're looking for, but it has the nice side effect of sorting the buckets numerically.

Or prefix type with zero.

... | eval type=if(type<10,"0"+type,type) | timechart ...

The way we found to do this was with a subsearch and return $field.

• get your sorting criteria (we ran stats on a subset of the source data)
• sort the results
• use fields to pull only the field used for your series
• mvcombine to turn all the records into a single one
• then eval with mvjoin to make it into a comma or space-delimited string
• output with return $<your list field> (the $ returns only the field's value)

Probably a more efficient way out there, but this seems to work.