Splunk Search

How do you display response time results sorted in descending order ?

navd
New Member

I am trying to display response times in a chart for my services. But, how do I display the response times results in chart in descending order (Highest number first)?

<myBaseSearch> | eval Date=strftime(_time, "%Y-%m-%d")  | chart avg(response_time) over services by Date  | rename * as avg_*  | rename avg_services as services   | foreach avg_* [eval "<<FIELD>>"= round('<<FIELD>>',2)]  | rename avg_* as *
0 Karma
1 Solution

mayurr98
Super Champion

hey @navd,

You can not do that if you have multiple services , because you have got multiple columns and you are actually sorting on multiple columns which is logically not possible.

However, you can sort on 1 column(1 service) using | sort - servicename but other columns will automatically adjust.

let me know if this helps!

View solution in original post

mayurr98
Super Champion

hey @navd,

You can not do that if you have multiple services , because you have got multiple columns and you are actually sorting on multiple columns which is logically not possible.

However, you can sort on 1 column(1 service) using | sort - servicename but other columns will automatically adjust.

let me know if this helps!

navd
New Member

Ya now I understand why my sorting didn't work . Thank you

0 Karma

woodcock
Esteemed Legend

Add this to the end:

| sort 0 - YourFieldWithCountHere
0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...