topic Re: Show a particular column as the last column always in Splunk Search

Show a particular column as the last column always

jiaqya — Mon, 02 Mar 2020 19:47:31 GMT

i have a table as below.

one two three four total five six

i want the "total" column to be shown at the end always, like below, need help to do this..

one two three four five six total.

also note that the column names are dynamic and can change, but "total" column name remains the same..

jiaqya — Mon, 02 Mar 2020 20:11:20 GMT

did this using below:

|search query
|rename total as T
|eval total=T
|fields - T

this ends up the column total at the end, right most ..

jiaqya — Mon, 02 Mar 2020 20:11:36 GMT

did this using below:

|search query
|rename total as T
|eval total=T
|fields - T

this ends up the column total at the end, right most ..

jpolvino — Mon, 02 Mar 2020 21:17:21 GMT

Another way to do it:

| makeresults | fields - _time
| eval a=1,b=2,c=3,d=4
| eval Total=a+b+c
| table * Total

Using the table command, you can force the field order. In this example, it is saying "list all the fields but put Total at the end."

a   b   c   d   Total
1   2   3   4   6