topic How to customize and sort columns with specific conditions? in Splunk Search

How to customize and sort columns with specific conditions?

AKG1_old1 — Wed, 30 Sep 2020 00:05:53 GMT

Hi,

I am looking to sort column with specific condition.

Condition:
if column Context_Command contains * it should be down in list and all the rows which doesn't have * in Context_Command
should be up in the list.

Re: How to customize and sort columns with specific conditions?

grittonc — Mon, 15 Apr 2019 12:17:20 GMT

Try adding this to your search:

...
|eval has_star=if(match(Context_Command, "\*"), 1, 0)
|sort has_star, Context_Command 
|fields - has_star

Here is a run-anywhere example:

| makeresults 
| eval foo="I have a *" 
| eval has_star=if(match(foo, "\*"), 1, 0) 
| append 
    [| makeresults 
    | eval foo="I don't have a star" 
    | eval has_star=if(match(foo, "\*"), 1, 0)] 
| sort has_star, foo
| fields - has_star

Note that you have to use the match command because regular expressions are the only way to match a literal wildcard. You probably already figured out that Context_Command="*" doesn't work.

Re: How to customize and sort columns with specific conditions?

martinpu — Mon, 15 Apr 2019 12:19:55 GMT

Try something like this:

  | rex field=Context_Command "(?<sortingVariable>\*)"
| table Context_Command sortingVariable 
| fillnull
| sort -sortingVariable

Add whatever additional fields you want to the table commands, and it should work,
I tested it with this query:

| makeresults 
| eval Context_Command="*,*,23,1123*23,4224,232*2,1111,***1" 
| makemv Context_Command delim=","
| fields Context_Command
| stats count by Context_Command
| rex field=Context_Command "(?<sortingVariable>\*)"
| table Context_Command sortingVariable 
| fillnull
| sort -sortingVariable