topic Re: can we sort command for sorting the table records rowwise in Splunk Search

can we sort command for sorting the table records rowwise

rakesh_498115 — Tue, 05 Jun 2012 19:16:59 GMT

Hi..

My search query displays the search results in the form of a table like this...

SearchParameter A B C D E
xyz 9 4 10 5 6

where xyz is the search parameter .actually i need the table to be sorted like this...

SearchParameter B D E A C
xyz 4 5 6 9 10

tried sort command but couldn't get the desired results ..

My search Query is like this...

sourcetype="X" (somelogic) | transaction keepevicted=true searchparameter | chart avg(duration) by
eventtype,searchparameter

Thanx

Re: can we sort command for sorting the table records rowwise

Ayn — Tue, 05 Jun 2012 21:30:59 GMT

If you know from the start which values you will be getting in the column headers, use table.

... | chart avg(duration) by eventtype,SearchParameter | table SearchParameter B D E A C

Re: can we sort command for sorting the table records rowwise

rakesh_498115 — Wed, 06 Jun 2012 09:16:52 GMT

actaully we will not be knowing this information.after excuting the query we will be getting the values for the fields A,B,C,D,E and i need to arrange them in descending order..

Re: can we sort command for sorting the table records rowwise

Ayn — Wed, 06 Jun 2012 09:19:51 GMT

Then I don't understand what you want to achieve. If you want to have stuff in the order B D E A C, but you don't know what B D E A C actually is, how are you (or Splunk) supposed to define the correct order? Also, descending order according to what?

Re: can we sort command for sorting the table records rowwise

rakesh_498115 — Wed, 06 Jun 2012 09:47:47 GMT

see the fields which i mentioned above are eventtypes ..so i dont know wat avg(duration) values will be coming for these eventtypes based on the searchparameter..and now i want to sort them as shown above

Re: can we sort command for sorting the table records rowwise

rakesh_498115 — Wed, 06 Jun 2012 09:54:29 GMT

sourcetype="X" (somelogic) | transaction keepevicted=true searchparameter | chart avg(duration) by eventtype,searchparameter

this is my search query . in this search query if i use stats instead of chart .. i am getting the output like this..

searchparameter eventtype avg(duration)

xyz A 9
xyz B 4
xyz C 10
xyz D 5
xyz E 6

Now if i use sort command my data is sorting .but the table appears as it is.plz help

Re: can we sort command for sorting the table records rowwise

Ayn — Wed, 06 Jun 2012 10:17:47 GMT

Ah, OK. I don't think you can change the column order according to column values (if you could, how would Splunk handle different orders in different rows?)

Re: can we sort command for sorting the table records rowwise

rakesh_498115 — Wed, 06 Jun 2012 10:25:43 GMT

acutally my searchquery returns only one row..so is it possible to change the column order according to column values..

Re: can we sort command for sorting the table records rowwise

Ayn — Wed, 06 Jun 2012 11:44:39 GMT

Yes, but I'm talking about the general functionality here. Reordering could perhaps be done in YOUR case with just one row, but to make a general solution out of it would be tricky and/or non-intuitive.

Re: can we sort command for sorting the table records rowwise

rakesh_498115 — Wed, 06 Jun 2012 14:55:23 GMT

if its possible ..can you pls provide me the solution for jus one row..how to reorder the row..

Re: can we sort command for sorting the table records rowwise

Ayn — Wed, 06 Jun 2012 20:54:27 GMT

I don't know of any way to accomplish what you want.