topic Re: Reordering fields in Splunk Search

Reordering fields

mnj1809 — Mon, 15 Jan 2024 12:18:06 GMT

Hello Splunkers,

I've a Region filter over the dashboard. This Region filter has values AMER and EMEA.

I've a requirement to reorder the above fields based on the selection of Region filter as follows. I want "<Region> Mandatory" field to be appear before "<Region> All"

Thanks in advance.

@tscroggins @yuanliu @bowesmana

Re: Reordering fields

gcusello — Mon, 15 Jan 2024 12:20:38 GMT

Hi @mnj1809,

could you share your search and the possible values for regions in text mode?

Ciao.

Giuseppe

Re: Reordering fields

ITWhisperer — Mon, 15 Jan 2024 12:46:47 GMT

Try putting an extra space before Mandatory so that lexicographical sorting will prioritise above single spaced values

| foreach "* Mandatory" [| rename "<<FIELD>>" as "<<MATCHSEG1>> Mandatory"]

Re: Reordering fields

mnj1809 — Mon, 15 Jan 2024 13:06:24 GMT

Thanks @ITWhisperer. It work like a charm.