|
Hey, In Splunk, you can sort your search results by field using the sort command. Is it possible to sort search results by row? E.g. If I have a search that produces the following table:
and what I really want instead is this table below (showing the days in order):
How would I be able to do this? Is this possible in Splunk? (Numbers 1-5 are just Splunk default table row numbers) |
|
There is a solution, it's a little complicated though. You would need to create a field that can be sorted on first, since sorting on weekdays would sort in alphabetical order. |
|
I suspect that you need to use rex to create a field for the total and then sort by that field. |
