Dashboards & Visualizations

Sort to show error on top in pivot table

shakSplunk
Path Finder

Hi all,

I currently have a pivot table which has column named 'alias'. I was wondering is there a way to sort that column such that the value "error" always shows up on top, then the remaining values will show under it.

The default alphabetical orders don't work here as in both alphabetical and reverse alphabetical order, error does not show up ontop and instead shows up somewhere in the middle. 

Any help would be greatly appreciated!

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try something like this

| eval alias=if(alias="error"," error",alias)
| sort alias
| eval alias=if(alias=" error","error",alias)
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...