topic Re: Set Sort Order in Splunk Panel in Splunk Search

Set Sort Order in Splunk Panel

chlebs — Wed, 19 Jul 2017 11:24:59 GMT

I have made a dashboard with a few panels on it, each of which contains a _time field and an environment field that the panels are sorted by. The primary sorting field is environment, then _time comes second. Below I will place an example search from one of the panels. I am wondering if I can preset the order of the sorting. There are 4 possible values for the environment variable: Test, Stage, Train, and Production. That is the order they should be in, but the sort command sorts alphabetically and places them in the order: Train, Test, Stage, Production. Thank you in advance to anyone who helps me with this.

Example Code:

index=java sourcetype=j2ee source="/opt/jbosslogs/profileData.log" web{ profile=$app_tok$ | eval environment=case(like(host, "%t"), "Test", like(host, "%s"), "Stage", like(host, "%n"), "Train", like(host, "%p"), "Production") | table _time, environment, host, proxy_name, path, pattern | sort -environment, _time

Re: Set Sort Order in Splunk Panel

Grumpalot — Wed, 19 Jul 2017 12:04:29 GMT

Here is sort based on example 5 of Sort from http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Sort

index=java sourcetype=j2ee source="/opt/jbosslogs/profileData.log" web{ profile=$app_tok$ | eval environment=case(like(host, "%t"), "Test", like(host, "%s"), "Stage", like(host, "%n"), "Train", like(host, "%p"), "Production") | table _time, environment, host, proxy_name, path, pattern | eval sort_environment=case(environment=="Train",1, environment=="Test",2, environment=="Stage",3, environment=="Production",4) | sort -sort_environment, _time | fields - sort_environment

Re: Set Sort Order in Splunk Panel

Grumpalot — Wed, 19 Jul 2017 12:10:16 GMT

With the reverse of Test, Stage, Train, and Production

Production = 4
Train = 3
Stage = 2
Test = 1

Sorry missed the order was more of a -- this should work for you just have to change the parameters.

Re: Set Sort Order in Splunk Panel

chlebs — Wed, 19 Jul 2017 12:27:56 GMT

Clever answer! This seems like common sense now that I see it. I must've been too caught up in the problem to find the solution. Thank you so much!