I am trying to display response times in a chart for my services. But, how do I display the response times results in chart in descending order (Highest number first)?
<myBaseSearch> | eval Date=strftime(_time, "%Y-%m-%d") | chart avg(response_time) over services by Date | rename * as avg_* | rename avg_services as services | foreach avg_* [eval "<<FIELD>>"= round('<<FIELD>>',2)] | rename avg_* as *
hey @navd,
You can not do that if you have multiple services
, because you have got multiple columns and you are actually sorting on multiple columns which is logically not possible.
However, you can sort on 1 column(1 service) using | sort - servicename
but other columns will automatically adjust.
let me know if this helps!
hey @navd,
You can not do that if you have multiple services
, because you have got multiple columns and you are actually sorting on multiple columns which is logically not possible.
However, you can sort on 1 column(1 service) using | sort - servicename
but other columns will automatically adjust.
let me know if this helps!
Ya now I understand why my sorting didn't work . Thank you
Add this to the end:
| sort 0 - YourFieldWithCountHere