topic Re-order table columns with dynamic names? in Splunk Search

Re-order table columns with dynamic names?

mspoerr — Mon, 29 Aug 2022 13:17:19 GMT

Hello,

I have a chart with dynamic field names displayed as table and would like to change the order of the columns:

Name Season 1 Season 2 Season 3 Name1 10000 11111 22222 Name2 9999 9997 9998 Name3 7777 5555 6666

How can I change the order of the columns? The number of Seasons is flexible and it should always start with the latest one -> Name Season3 Season2 Season1

Re: Re-order table columns with dynamic names

ITWhisperer — Sun, 28 Aug 2022 18:50:19 GMT

| transpose 0 header_field=Name column_name=Name | sort 0 - Name | transpose 0 header_field=Name column_name=Name

Re: Re-order table columns with dynamic names

mspoerr — Mon, 29 Aug 2022 06:45:46 GMT

Is it possible to get more control over the sorting? There are more columns which I omitted in my original question.

Re: Re-order table columns with dynamic names

ITWhisperer — Mon, 29 Aug 2022 06:52:18 GMT

Sort of non-numeric fields is done lexicographically. It can be ascending or descending. If you want the columns sorted another way, you may have to add another field, possibly based on the name, which can then be sorted by, and then removed.