https://community.splunk.com/t5/Splunk-Search/How-do-I-keep-the-ordering-of-rows-on-the-result-of-a/m-p/180814#M52097 <P>Again, according to the doc, you can pass a list of fields instead of t/f values. So in your case, maybe something like:</P> <P><CODE>mvlist="Operation,Version,txn_id,Field Value"</CODE></P> Wed, 22 Oct 2014 17:27:45 GMT aweitzman 2014-10-22T17:27:45Z https://community.splunk.com/t5/Splunk-Search/How-do-I-keep-the-ordering-of-rows-on-the-result-of-a/m-p/180811#M52094 <P>I have splunk poll a database and return the results into a <CODE>transaction</CODE> command. The transaction command groups the rows by key (which is whited-out, below) with <CODE>maxevents=2</CODE>. However, the results of that <CODE>transaction</CODE> appear disjointed. Below, the column containing the values 0.886, 0.88695, etc. is a historic column showing the historic values of the field. So at one point, field 'rate' has value '0.92695' but it was deleted and the value '0.9314' was inserted instead.</P> <P>As you can see, the values don't appear logically - the 3rd row from bottom breaks the 'previous value top, new value bottom'. I want this ordering to be consistent on the whole column, so the user knows that the previous value will always be on the top. How do I do this?</P> <P>I think what's going on is that splunk is taking the values of the transaction, combining them together and then ordering each column in ascending order individually and breaking the row mappings. I want it so that the rows keep their mappings.</P> <P><IMG src="http://i.stack.imgur.com/ar3UM.jpg" alt="alt text" /></P> Wed, 22 Oct 2014 15:31:23 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-keep-the-ordering-of-rows-on-the-result-of-a/m-p/180811#M52094 sjanwity 2014-10-22T15:31:23Z https://community.splunk.com/t5/Splunk-Search/How-do-I-keep-the-ordering-of-rows-on-the-result-of-a/m-p/180812#M52095 <P>Based on <A href="http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Transaction">http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Transaction</A> I think <CODE>mvlist=t</CODE> ought to do what you want.</P> Wed, 22 Oct 2014 15:39:52 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-keep-the-ordering-of-rows-on-the-result-of-a/m-p/180812#M52095 aweitzman 2014-10-22T15:39:52Z https://community.splunk.com/t5/Splunk-Search/How-do-I-keep-the-ordering-of-rows-on-the-result-of-a/m-p/180813#M52096 <P>but then it repeats the same items on the line? Like it repeats my key even though the key is the same.</P> Wed, 22 Oct 2014 17:09:46 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-keep-the-ordering-of-rows-on-the-result-of-a/m-p/180813#M52096 sjanwity 2014-10-22T17:09:46Z https://community.splunk.com/t5/Splunk-Search/How-do-I-keep-the-ordering-of-rows-on-the-result-of-a/m-p/180814#M52097 <P>Again, according to the doc, you can pass a list of fields instead of t/f values. So in your case, maybe something like:</P> <P><CODE>mvlist="Operation,Version,txn_id,Field Value"</CODE></P> Wed, 22 Oct 2014 17:27:45 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-keep-the-ordering-of-rows-on-the-result-of-a/m-p/180814#M52097 aweitzman 2014-10-22T17:27:45Z https://community.splunk.com/t5/Splunk-Search/How-do-I-keep-the-ordering-of-rows-on-the-result-of-a/m-p/180815#M52098 <P>doh...I saw <CODE>(bool)</CODE> in the <CODE>mvlist</CODE> parameter list and didnt bother reading the rest of the line...whoops!</P> <P>I created a macro which combines the rows if they're the same in the meantime. Interestingly, it makes the search take 0.8 seconds (5.9-&gt;5.1) quicker manually combining each row! </P> Wed, 22 Oct 2014 17:50:38 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-keep-the-ordering-of-rows-on-the-result-of-a/m-p/180815#M52098 sjanwity 2014-10-22T17:50:38Z https://community.splunk.com/t5/Splunk-Search/How-do-I-keep-the-ordering-of-rows-on-the-result-of-a/m-p/180816#M52099 <P>Hi, the solution works fine but is it possible for the 'VERSION' column to be sorted ascendingly (i.e. bigger value always on top) and the rows to be reflected as such? Currently the row mappings match but the ordering is still quite random</P> Tue, 04 Nov 2014 15:18:42 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-keep-the-ordering-of-rows-on-the-result-of-a/m-p/180816#M52099 sjanwity 2014-11-04T15:18:42Z https://community.splunk.com/t5/Splunk-Search/How-do-I-keep-the-ordering-of-rows-on-the-result-of-a/m-p/180817#M52100 <P>I'm sorry, I don't think this is possible. Once the events are bundled into a transaction, your ability to order them as individual rows effectively disappears.</P> <P>So your solution might be instead to order your events by <CODE>VERSION</CODE> first, and then apply the transaction command to them.</P> Wed, 05 Nov 2014 15:25:41 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-keep-the-ordering-of-rows-on-the-result-of-a/m-p/180817#M52100 aweitzman 2014-11-05T15:25:41Z