Splunk Search

Can if function be used with sort?

Explorer

I am working on a dashboard that has a radio button that can change a search between the two of the following

| stats count by fieldA 

or

| stats dc(fieldA)

At the end of this search I would like to have a sort based on whether or not count or distinct count is being used.

sort - count

or

sort - distinct_count

Is this something that I can accomplish using the if function? The following is a non functional example of what I would like to do something like.

if(count==disctinct_count, sort - distinct_count, sort - count)

Thank you for any insight you might have.

0 Karma

Contributor
| eval sort_field = if(count==disctinct_count, distinct_count, count)
| sort -sort_field

You can try this.
Hope this helps, Thanks!

0 Karma

Motivator

No, there is no way to do this that I'm familiar with.

Could you just try changing one of the stats functions to rename the field? E.g. change:

| stats dc(fieldA)

to

| stats dc(fieldA) as count

then, keep the normal sort

| sort - count

Cheers,
Jacob
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!