Splunk Search

How can I sort the split columns in this pivot?

tkwaller_2
Communicator

Hello

I have a dataset that I created along with a pivot table. the table has a split column called RR_Score which is an eval field in the dataset. This field evals a field called score and creates criticality as Critical, High, Medium, Low, Nominal and None. I want it sorted in that order specifically BUT I cannot do that, it only sorts alphabetically. I tried eval'ing a new field called
sortingSequence that does this:

case(RR_Score="Critical", 1, RR_Score="High", 2, RR_Score="Medium", 3, RR_Score="Low", 4, RR_Score="Nominal", 5, RR_Score="None", 6,1=1, 0)

However it doesn't sort in regular search nor in pivot, I don't want to display the field either. just want to order the RR_Score fields.

The search looks something like this:

| pivot RiskEvalData RiskEvalData count(info_name) AS "Count of Vendor" SPLITROW info_owner_subsidiary AS Subsidiary SPLITROW info_owner_deptTechnical AS "Technical Dept" SPLITROW info_owner_deptBusiness AS LOB SPLITCOL RR_Score SORT 1000 sortingSequence ROWSUMMARY 1 COLSUMMARY 1 NUMCOLS 100 SHOWOTHER 1

I have attached a screenshot of the pivot table.
alt text

Any thought how I can get the RR_Score fields sorted properly?
Thanks as always!

0 Karma
1 Solution

somesoni2
Revered Legend

You can try thi, If the values for field RR_Score are fixed and you always want all columns to be present.

| pivot RiskEvalData RiskEvalData count(info_name) AS "Count of Vendor" SPLITROW info_owner_subsidiary AS Subsidiary SPLITROW info_owner_deptTechnical AS "Technical Dept" SPLITROW info_owner_deptBusiness AS LOB SPLITCOL RR_Score SORT 1000 sortingSequence ROWSUMMARY 1 COLSUMMARY 1 NUMCOLS 100 SHOWOTHER 1
| table Subsidiary  "Technical Dept" LOB Critical High Medium Low Nominal None ALL

View solution in original post

somesoni2
Revered Legend

You can try thi, If the values for field RR_Score are fixed and you always want all columns to be present.

| pivot RiskEvalData RiskEvalData count(info_name) AS "Count of Vendor" SPLITROW info_owner_subsidiary AS Subsidiary SPLITROW info_owner_deptTechnical AS "Technical Dept" SPLITROW info_owner_deptBusiness AS LOB SPLITCOL RR_Score SORT 1000 sortingSequence ROWSUMMARY 1 COLSUMMARY 1 NUMCOLS 100 SHOWOTHER 1
| table Subsidiary  "Technical Dept" LOB Critical High Medium Low Nominal None ALL

tkwaller_2
Communicator

For the win!

That was it. For some reason I didn't think about tabling again. Thanks again!

0 Karma

DalJeanis
Legend

@tkwaller_2 - if your issue has been solved, please accept the answer that solved it. Feel free to upvote any answers or comments that you found particularly helpful as well, on your own or other people's questions.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...