topic Re: Can if function be used with sort? in Splunk Search

Can if function be used with sort?

kamryn — Mon, 29 Jul 2019 14:09:29 GMT

I am working on a dashboard that has a radio button that can change a search between the two of the following

| stats count by fieldA

| stats dc(fieldA)

At the end of this search I would like to have a sort based on whether or not count or distinct count is being used.

sort - count

sort - distinct_count

Is this something that I can accomplish using the if function? The following is a non functional example of what I would like to do something like.

if(count==disctinct_count, sort - distinct_count, sort - count)

Thank you for any insight you might have.

jacobpevans — Mon, 29 Jul 2019 14:43:00 GMT

No, there is no way to do this that I'm familiar with.

Could you just try changing one of the stats functions to rename the field? E.g. change:

| stats dc(fieldA)

| stats dc(fieldA) as count

then, keep the normal sort

| sort - count

sandeepmakkena — Wed, 16 Oct 2019 17:34:39 GMT

| eval sort_field = if(count==disctinct_count, distinct_count, count)
| sort -sort_field

You can try this.
Hope this helps, Thanks!