Splunk Search

How can I have a pivot table sorted by the sum of column values automatically instead of manually sorting each time?

clifforg
Explorer

I have created a pivot table in the Pivot Builder and it shows the information that I need. However, I want the pivot table sorted by the SUM of the column values (which is the data I am showing) rather than the "split rows" field. I can sort the pivot table manually each time by clicking the column header - but how do I save this into the pivot table?

I cannot simple sort the source data as the pivot table is doing the sum on the source data for me.

tdhellma
New Member

You should be able to sort the sum done in your pivot as long as you put a pipe between them so that the sum command can return results before you try to sort on its results.

Here's an example from something I'm working on that sounds similar to what you're trying to do - sort results descending on a sum column:

| pivot Sale Sale sum(Cost) AS "Sum of Cost" SPLITROW Publisher | sort -"Sum of Cost"

Through the Pivot builder GUI you can also select the sort dropdown under the x-axis header to sort some types of visualizations.

Let me know if this didn't answer your question.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...