Hello People, how Do I modify the order in which a table is showing the rows? I have no intent in ordering in terms of columns values or in alphabetical order, I rather want to have the rows shown in a organize format for example mi table looks like
DETAIL TOTAL
A 458
B 45
C 12
How can I have my table to look like this:
DETAIL TOTAL
B 45
A 458
C 12
These results come from a stats command .. I have even tried to change the order in the stats command but that did not work
Could you not include the Mall opening date in the stats command then remove the column?
| makeresults
| eval _raw="Store,Mall,Count
B,2001,2
A,2002,5
C,2003,7"
| multikv forceheader=1
| fields - _* linecount
| stats sum(Count) as Count by Mall, Store
| fields - Mall
Hello thanks, I want to organize the table tat I get from the stats command | stats count by DEPARTMENT in the order in which the shopping mall was built... I figured that if I add a number at the begining of the word I cound the organize the names of the deparment but my boss does not want that.. so my order does not hold "any logical" mean to splunk I just want a cartain deparment to be shown first that other in the table. thanks!
Could you not include the Mall opening date in the stats command then remove the column?
| makeresults
| eval _raw="Store,Mall,Count
B,2001,2
A,2002,5
C,2003,7"
| multikv forceheader=1
| fields - _* linecount
| stats sum(Count) as Count by Mall, Store
| fields - Mall
How do you want to "organize" the table if not by sorting? What criteria are you going to use to decide which comes first, second, etc?