topic Re: Ordering Columns Not Working in Splunk Search

Ordering Columns Not Working

matthewcanty — Mon, 28 Sep 2020 12:12:04 GMT

http://splunk-base.splunk.com/answers/49712/can-we-sort-command-for-sorting-the-table-records-rowwise

Hi All,

I have a column chart and want to order the columns. The above link isn't quite what I am looking for. My search query is as follows, and works all apart from I'd like it ordering.

host="*90*" FeedSource | search Fixture>0 | stats max(_time) As LatestTime By Action | eval Gap=time()-LatestTime | chart last(Gap) by Action`

How can I order the fields such as CACHE_INSERT CACHE_UPDATE etc?

Many thanks in advance.

Re: Ordering Columns Not Working

lguinn2 — Mon, 06 Aug 2012 21:44:40 GMT

I am not sure this will work, but try putting the table command at the end of your search, listing the fields in the order that you want them to appear. Be sure to list them all!

host="*90*" FeedSource Fixture>0 
| stats max(_time) As LatestTime By Action 
| eval Gap=time()-LatestTime 
| chart last(Gap) as lastGap by Action
| table CACHE_INSERT CACHE_UPDATE

I do see some problems with this. First time() is the current wall clock time - even if you want the "current" time, I would use now(). now() is when the search began, and so it will be consistent for all events in this search. But time() will vary based on how long this search takes to run.

The second problem is that your table command must list all the values of Action. If these change, then your search must be updated.

Re: Ordering Columns Not Working

matthewcanty — Tue, 07 Aug 2012 08:25:49 GMT

Thanks, seems to have had the same effect as in the link I posted in my question. Also using now() in a real-time search causes the results to gradually move into greater negative values.

Re: Ordering Columns Not Working

lguinn2 — Tue, 07 Aug 2012 08:34:53 GMT

Sorry - didn't know this was a RT search - then time() IS a better choice.

Re: Ordering Columns Not Working

lguinn2 — Tue, 07 Aug 2012 08:37:18 GMT

Would it make sense to use the stats command instead of the chart command?