topic Re: Refer to a field in table by its position in Splunk Search

Refer to a field in table by its position

nabeel652 — Tue, 16 Jul 2019 03:51:49 GMT

Wondering if we can do something like this:

... | table * | sort by <1>

Where <1> refers to the first field in the table as the field names are dynamic and subject to change.

jkat54 — Tue, 16 Jul 2019 04:25:33 GMT

Try this

 | stats values(*) as * | sort 0 *

nabeel652 — Tue, 16 Jul 2019 04:47:47 GMT

Nope, this will group everything up in one cell which is not the desired outcome 🙂

HiroshiSatoh — Tue, 16 Jul 2019 05:52:20 GMT

If the order of field names is acceptable

 ... | table * |sort [search (your search)|head 1 | table * | stats dc(*) as * | transpose |head 1|rename column as query]

nabeel652 — Tue, 16 Jul 2019 06:12:43 GMT

Awesome, that worked. Can you please explain this?

| rename column as query

HiroshiSatoh — Wed, 30 Sep 2020 01:22:59 GMT

The return value will be the value only. Usually field = value.

special field：query

index=* [inputlookup xxx.csv | fields col_a]
->(col_a=1) OR (col_a=2) OR (col_a=3) ・・・・

index=* [inputlookup xxx.csv | rename col_a as query | fields query]
->(1) OR (2) OR (3) ・・・・