Splunk Search

How can I have a pivot table sorted by the sum of column values automatically instead of manually sorting each time?

clifforg
Explorer

I have created a pivot table in the Pivot Builder and it shows the information that I need. However, I want the pivot table sorted by the SUM of the column values (which is the data I am showing) rather than the "split rows" field. I can sort the pivot table manually each time by clicking the column header - but how do I save this into the pivot table?

I cannot simple sort the source data as the pivot table is doing the sum on the source data for me.

tdhellma
New Member

You should be able to sort the sum done in your pivot as long as you put a pipe between them so that the sum command can return results before you try to sort on its results.

Here's an example from something I'm working on that sounds similar to what you're trying to do - sort results descending on a sum column:

| pivot Sale Sale sum(Cost) AS "Sum of Cost" SPLITROW Publisher | sort -"Sum of Cost"

Through the Pivot builder GUI you can also select the sort dropdown under the x-axis header to sort some types of visualizations.

Let me know if this didn't answer your question.

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...