Splunk Search

How can I have a pivot table sorted by the sum of column values automatically instead of manually sorting each time?

Explorer

I have created a pivot table in the Pivot Builder and it shows the information that I need. However, I want the pivot table sorted by the SUM of the column values (which is the data I am showing) rather than the "split rows" field. I can sort the pivot table manually each time by clicking the column header - but how do I save this into the pivot table?

I cannot simple sort the source data as the pivot table is doing the sum on the source data for me.

New Member

You should be able to sort the sum done in your pivot as long as you put a pipe between them so that the sum command can return results before you try to sort on its results.

Here's an example from something I'm working on that sounds similar to what you're trying to do - sort results descending on a sum column:

| pivot Sale Sale sum(Cost) AS "Sum of Cost" SPLITROW Publisher | sort -"Sum of Cost"

Through the Pivot builder GUI you can also select the sort dropdown under the x-axis header to sort some types of visualizations.

Let me know if this didn't answer your question.

0 Karma