Reporting

Sort column in a report based on _time in descending order

pdantuuri0411
Explorer

Hi, We have reports and they are configured to be based on _time in Ascending order. However, I want to configure them to be in descending order.

0 Karma
1 Solution

Sukisen1981
Champion
0 Karma

Sukisen1981
Champion

| sort - _time

0 Karma

pdantuuri0411
Explorer

Thank you for the quick reply. Below is my query for the report. I am having trouble to understand where should the argument you mentioned be placed. Also is there a way where this can be done in the pivot?

| pivot servicestrafficcaapimodel servicesapielsproductionds count(servicesapielsproductionds) AS count SPLITROW _time AS _time PERIOD day SPLITROW service AS service SPLITROW operation AS operation SPLITROW method AS method SPLITROW principal AS principal SPLITROW systemid AS systemid SORT 100 _time ROWSUMMARY 0 COLSUMMARY 0 SHOWOTHER 1

0 Karma

Sukisen1981
Champion

if you have a _time field in your output place it at the last..can you share a snapshot of your output?

0 Karma

pdantuuri0411
Explorer

Thank you for the quick reply. I am able to get the results required.

However, I don't have permission to change the query to extract the result. All I can do is change the configuration in the pivot. Is there a way where I can do this through Pivot. I see I can change the report to get the results in ascending order.

Thank you

0 Karma

Sukisen1981
Champion

Configuration options specific to split row elements regardless of field type

Label - Use this to override the field name with a different text string for reporting purposes. For example, you can use it to ensure that an field titled "product name" displays as "Product" in the pivot.
Sort - How the split rows that the element creates should be sorted. Available values are Default, Descending, and Ascending. The default is Default.
When the Sort value is Default Splunk software sorts the rows naturally by the field type of the first split. In other words, if the first split is on uri (a string field), the rows will be sorted alphabetically by the value of uri. If it is on _time (a timestamp field) the rows will be sorted in ascending chronological order.
When the Sort value is Descending or Ascending, the rows will be sorted by the value of the first Column Values element that outputs a metric value (via an aggregation operation like count, sum, average, and so on).
your first split should be on _time and sort value as descending

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...