Splunk Search

Eval fields are returned in strange order when using transaction and join commands

fere
Path Finder

I have defined thw following search, but it returns the fields in the wrong order:

source="xxxx" | eventTransIncludeOrphans("step1Invite","step1end" ) | stats count as all_req_invite_count, count(eval(_txn_orphan=1)) as req_invite_orphan_count | eval dropPct = req_invite_orphan_count/ all_req_invite_count * 100 | join nextStep [search source="xxxx" |eventTransIncludeOrphans("step2Invite","step2end" ) | stats count as all_req_invite_count2, count(eval(_txn_orphan=1)) as req_invite_orphan_count2 | eval dropPct2 = req_invite_orphan_count2/ all_req_invite_count2 * 100 ]

the fields show up in the following order - dropPct adn dropPct2 are in wrong places:

all_req_invite_count    req_invite_orphan_count all_req_invite_count2   dropPct dropPct2    req_invite_orphan_count2

If I don't include the 2 pct fields, the 4 fields returned show up in the order that were defined.
How can I make them all show up in the order that were defined in the search string?
Thanks

Tags (3)
0 Karma
1 Solution

cphair
Builder

You can reorder the fields by piping your whole search to the fields command, specifying the order you want them to take.


... | fields all_req_invite_count, req_invite_orphan_count, dropPct, all_req_invite_count2, req_invite_orphan_count2, dropPct2
</code.

View solution in original post

0 Karma

cphair
Builder

You can reorder the fields by piping your whole search to the fields command, specifying the order you want them to take.


... | fields all_req_invite_count, req_invite_orphan_count, dropPct, all_req_invite_count2, req_invite_orphan_count2, dropPct2
</code.

0 Karma

fere
Path Finder

thx, worked.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...