topic Re: how to position a column as the left most column in the statistics view in Splunk Search

how to position a column as the left most column in the statistics view

HattrickNZ — Tue, 07 Apr 2015 03:13:36 GMT

I have the following search And I add this column row to show the row numbers but it positions in as the right most column.

...| streamstats count as row

I don't want this I want to position it as the leftmost column. How can I do this? I am pretty sure i have seen this before somewhere.

Re: how to position a column as the left most column in the statistics view

rsennett_splunk — Tue, 07 Apr 2015 03:39:51 GMT

add a by clause, although unless there is more to this... you mean stats not streamstats. As you have it you'll only produce events not statistics in columns.

so, stats count as row by something

something will be on the left, and row on the right.

Re: how to position a column as the left most column in the statistics view

HattrickNZ — Tue, 07 Apr 2015 04:00:30 GMT

tks will try that but it was not exactly what I was looking for. I thought there was a nother way?

Re: how to position a column as the left most column in the statistics view

ramdaspr — Tue, 07 Apr 2015 04:14:19 GMT

Use the table command at the end and specify row as the first field to force the layout you need.

..| streamstats count as row | table row,field1,field2,field3

Re: how to position a column as the left most column in the statistics view

HattrickNZ — Tue, 07 Apr 2015 23:43:11 GMT

tks that will do. I am still thinking there is another way but just not sure what it is.

Re: how to position a column as the left most column in the statistics view

ramdaspr — Wed, 08 Apr 2015 00:27:29 GMT

If you are trying to show it on a dashboard table, you can use the rowNumbers option to display the row numbers which should by default show them leftmost.

AFAIK there arent any other options of explicitly ordering columns, so if you do find any other solutions so post them here..