Splunk Search

How can I have a pivot table sorted by the sum of column values automatically instead of manually sorting each time?

clifforg
Explorer

I have created a pivot table in the Pivot Builder and it shows the information that I need. However, I want the pivot table sorted by the SUM of the column values (which is the data I am showing) rather than the "split rows" field. I can sort the pivot table manually each time by clicking the column header - but how do I save this into the pivot table?

I cannot simple sort the source data as the pivot table is doing the sum on the source data for me.

tdhellma
New Member

You should be able to sort the sum done in your pivot as long as you put a pipe between them so that the sum command can return results before you try to sort on its results.

Here's an example from something I'm working on that sounds similar to what you're trying to do - sort results descending on a sum column:

| pivot Sale Sale sum(Cost) AS "Sum of Cost" SPLITROW Publisher | sort -"Sum of Cost"

Through the Pivot builder GUI you can also select the sort dropdown under the x-axis header to sort some types of visualizations.

Let me know if this didn't answer your question.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...