Splunk Search

can we sort command for sorting the table records rowwise

rakesh_498115
Motivator

Hi..

My search query displays the search results in the form of a table like this...

SearchParameter A B C D E
xyz 9 4 10 5 6

where xyz is the search parameter .actually i need the table to be sorted like this...

SearchParameter B D E A C
xyz 4 5 6 9 10

tried sort command but couldn't get the desired results ..

My search Query is like this...

sourcetype="X" (somelogic) | transaction keepevicted=true searchparameter | chart avg(duration) by
eventtype,searchparameter

Thanx

Tags (1)
0 Karma

Ayn
Legend

If you know from the start which values you will be getting in the column headers, use table.

... | chart avg(duration) by eventtype,SearchParameter | table SearchParameter B D E A C
0 Karma

Ayn
Legend

I don't know of any way to accomplish what you want.

0 Karma

rakesh_498115
Motivator

if its possible ..can you pls provide me the solution for jus one row..how to reorder the row..

0 Karma

Ayn
Legend

Yes, but I'm talking about the general functionality here. Reordering could perhaps be done in YOUR case with just one row, but to make a general solution out of it would be tricky and/or non-intuitive.

0 Karma

rakesh_498115
Motivator

acutally my searchquery returns only one row..so is it possible to change the column order according to column values..

0 Karma

Ayn
Legend

Ah, OK. I don't think you can change the column order according to column values (if you could, how would Splunk handle different orders in different rows?)

0 Karma

rakesh_498115
Motivator

sourcetype="X" (somelogic) | transaction keepevicted=true searchparameter | chart avg(duration) by eventtype,searchparameter

this is my search query . in this search query if i use stats instead of chart .. i am getting the output like this..

searchparameter eventtype avg(duration)

xyz A 9
xyz B 4
xyz C 10
xyz D 5
xyz E 6

Now if i use sort command my data is sorting .but the table appears as it is.plz help

0 Karma

rakesh_498115
Motivator

see the fields which i mentioned above are eventtypes ..so i dont know wat avg(duration) values will be coming for these eventtypes based on the searchparameter..and now i want to sort them as shown above

0 Karma

Ayn
Legend

Then I don't understand what you want to achieve. If you want to have stuff in the order B D E A C, but you don't know what B D E A C actually is, how are you (or Splunk) supposed to define the correct order? Also, descending order according to what?

0 Karma

rakesh_498115
Motivator

actaully we will not be knowing this information.after excuting the query we will be getting the values for the fields A,B,C,D,E and i need to arrange them in descending order..

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...