Splunk Search

How do you display response time results sorted in descending order ?

navd
New Member

I am trying to display response times in a chart for my services. But, how do I display the response times results in chart in descending order (Highest number first)?

<myBaseSearch> | eval Date=strftime(_time, "%Y-%m-%d")  | chart avg(response_time) over services by Date  | rename * as avg_*  | rename avg_services as services   | foreach avg_* [eval "<<FIELD>>"= round('<<FIELD>>',2)]  | rename avg_* as *
0 Karma
1 Solution

mayurr98
Super Champion

hey @navd,

You can not do that if you have multiple services , because you have got multiple columns and you are actually sorting on multiple columns which is logically not possible.

However, you can sort on 1 column(1 service) using | sort - servicename but other columns will automatically adjust.

let me know if this helps!

View solution in original post

mayurr98
Super Champion

hey @navd,

You can not do that if you have multiple services , because you have got multiple columns and you are actually sorting on multiple columns which is logically not possible.

However, you can sort on 1 column(1 service) using | sort - servicename but other columns will automatically adjust.

let me know if this helps!

navd
New Member

Ya now I understand why my sorting didn't work . Thank you

0 Karma

woodcock
Esteemed Legend

Add this to the end:

| sort 0 - YourFieldWithCountHere
0 Karma
Get Updates on the Splunk Community!

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...