In Splunk, you can sort your search results by field using the sort command.
Is it possible to sort search results by row?
E.g. If I have a search that produces the following table:
and what I really want instead is this table below (showing the days in order):
How would I be able to do this? Is this possible in Splunk? (Numbers 1-5 are just Splunk default table row numbers)
asked 22 Sep '10, 13:25
There is a solution, it's a little complicated though. You would need to create a field that can be sorted on first, since sorting on weekdays would sort in alphabetical order.
answered 22 Sep '10, 14:51
I suspect that you need to use rex to create a field for the total and then sort by that field.
answered 22 Sep '10, 14:18