topic Re: how to change the order of display of column in stats which is grouped by "count by" in Splunk Search

How to change the order of display of column in stats which is grouped by "count by"?

manimuthu — Mon, 02 May 2022 16:56:12 GMT

Hi all,

My query has,

.... | stats latest(time) as recent_event,latest(key) as recent_key, count by field1,field2

and the output has columns (order) like

field1 field2 recent_event recent_key count

(where count is obtained because of "count by")

Is it possible to change the order of the columns

recent_event count field1 recent_key field2

Re: how to change the order of display of column in stats which is grouped by "count by"

gcusello — Mon, 02 May 2022 14:34:53 GMT

Hi @manimuthu,

at the end of your search you have to add a table command, something like this:

Your_search | stats latest(time) as recent_event,latest(key) as recent_key, count by field1 field2 | table recent_event count field1 recent_key field2

Ciao.

Giuseppe

Re: how to change the order of display of column in stats which is grouped by "count by"

manimuthu — Mon, 02 May 2022 14:47:54 GMT

Thanks for replying but its not working for me

Re: how to change the order of display of column in stats which is grouped by "count by"

gcusello — Mon, 02 May 2022 14:51:47 GMT

Hi @manimuthu,

Why it isn't working for you, what's the limitation?

The only other option is to insert a row like this in the panel visualizing the search results:

<fields>recent_event,count,field1,recent_key,field2</fields>

Ciao.

Giuseppe

Re: how to change the order of display of column in stats which is grouped by "count by"

manimuthu — Mon, 02 May 2022 15:08:50 GMT

sorry i am totally new to splunk. the number of seach result differs before and after adding

| table recent_event count field1 recent_key field2

by using "count by " the events are grouped based on field1 & field2 (is my understanding correct) and the count of each group is displayed by default under count column.

Re: how to change the order of display of column in stats which is grouped by "count by"

gcusello — Mon, 02 May 2022 15:29:13 GMT

Hi @manimuthu,

this isn't possible, probably you're analyzing data from different time frames, if you analyze data e.g. of yesterday or one hour ago (in other words: until now), you'll have the same results, because the row I hinted to add doesn't change the results.

Anyway, yes, the stats command groups data by the two fields and gives the result in the count column.

For your knowledge, I hint to follow the Splunk Search Tutorial, to better understand how Splunk works https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial/WelcometotheSearchTutorial

Ciao.

Giuseppe