https://community.splunk.com/t5/Splunk-Search/Sort-based-on-first-count-generated-by-xyseries-dynamically/m-p/322600#M96307 <P>Hi - You can use the value of another field as the name of the destination field by using curly brackets, { }. For example, if you have an event with the following fields, aName=counter and aValue=1234. Use | eval {aName}=aValue to return counter=1234. </P> <P><A href="http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Eval">http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Eval</A></P> <P>Add a dynamic eval |eval {xxxx}=value, then | sort -eval {xxxx}</P> Sun, 22 Oct 2017 11:08:28 GMT Sukisen1981 2017-10-22T11:08:28Z https://community.splunk.com/t5/Splunk-Search/Sort-based-on-first-count-generated-by-xyseries-dynamically/m-p/322599#M96306 <P>I want to sort based on the 2nd column generated dynamically post using xyseries command <BR /> <CODE>index="aof_mywizard_deploy_idx" sourcetype="aof_tm_source" | rename "Timelines_<EM>FY17</EM> FY18_Q1" as "Completetion_date" |eval c_status=upper('Current Week Status') |search c_status!="TBC"| stats count(c_status) as count by Completetion_date c_status |eventstats sum(count) as Total by Completetion_date| eval ragcount% = (round((count/Total)<EM>100))."%"| xyseries c_status Completetion_date count ragcount%|rename "count: *" as "</EM>:Count" "ragcount%: <EM>" as "</EM>:Percent%" |table c_status *|rename c_status as "RAG STATUS" </CODE></P> <P>Columns generated are Rag status, FY17:Count FY17:percent% Fy18-Q1:count.. etc. I want to sort with the first count (in this case FY17:Count) . How can i do that? can some one please help? if i give sort - "FY17:Count" it works.. but since its dynamically generated , is there a way to handle this? </P> Tue, 29 Sep 2020 16:23:01 GMT https://community.splunk.com/t5/Splunk-Search/Sort-based-on-first-count-generated-by-xyseries-dynamically/m-p/322599#M96306 k_harini 2020-09-29T16:23:01Z https://community.splunk.com/t5/Splunk-Search/Sort-based-on-first-count-generated-by-xyseries-dynamically/m-p/322600#M96307 <P>Hi - You can use the value of another field as the name of the destination field by using curly brackets, { }. For example, if you have an event with the following fields, aName=counter and aValue=1234. Use | eval {aName}=aValue to return counter=1234. </P> <P><A href="http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Eval">http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Eval</A></P> <P>Add a dynamic eval |eval {xxxx}=value, then | sort -eval {xxxx}</P> Sun, 22 Oct 2017 11:08:28 GMT https://community.splunk.com/t5/Splunk-Search/Sort-based-on-first-count-generated-by-xyseries-dynamically/m-p/322600#M96307 Sukisen1981 2017-10-22T11:08:28Z