Splunk Search

How can I sort the split columns in this pivot?

tkwaller_2
Communicator

Hello

I have a dataset that I created along with a pivot table. the table has a split column called RR_Score which is an eval field in the dataset. This field evals a field called score and creates criticality as Critical, High, Medium, Low, Nominal and None. I want it sorted in that order specifically BUT I cannot do that, it only sorts alphabetically. I tried eval'ing a new field called
sortingSequence that does this:

case(RR_Score="Critical", 1, RR_Score="High", 2, RR_Score="Medium", 3, RR_Score="Low", 4, RR_Score="Nominal", 5, RR_Score="None", 6,1=1, 0)

However it doesn't sort in regular search nor in pivot, I don't want to display the field either. just want to order the RR_Score fields.

The search looks something like this:

| pivot RiskEvalData RiskEvalData count(info_name) AS "Count of Vendor" SPLITROW info_owner_subsidiary AS Subsidiary SPLITROW info_owner_deptTechnical AS "Technical Dept" SPLITROW info_owner_deptBusiness AS LOB SPLITCOL RR_Score SORT 1000 sortingSequence ROWSUMMARY 1 COLSUMMARY 1 NUMCOLS 100 SHOWOTHER 1

I have attached a screenshot of the pivot table.
alt text

Any thought how I can get the RR_Score fields sorted properly?
Thanks as always!

0 Karma
1 Solution

somesoni2
Revered Legend

You can try thi, If the values for field RR_Score are fixed and you always want all columns to be present.

| pivot RiskEvalData RiskEvalData count(info_name) AS "Count of Vendor" SPLITROW info_owner_subsidiary AS Subsidiary SPLITROW info_owner_deptTechnical AS "Technical Dept" SPLITROW info_owner_deptBusiness AS LOB SPLITCOL RR_Score SORT 1000 sortingSequence ROWSUMMARY 1 COLSUMMARY 1 NUMCOLS 100 SHOWOTHER 1
| table Subsidiary  "Technical Dept" LOB Critical High Medium Low Nominal None ALL

View solution in original post

somesoni2
Revered Legend

You can try thi, If the values for field RR_Score are fixed and you always want all columns to be present.

| pivot RiskEvalData RiskEvalData count(info_name) AS "Count of Vendor" SPLITROW info_owner_subsidiary AS Subsidiary SPLITROW info_owner_deptTechnical AS "Technical Dept" SPLITROW info_owner_deptBusiness AS LOB SPLITCOL RR_Score SORT 1000 sortingSequence ROWSUMMARY 1 COLSUMMARY 1 NUMCOLS 100 SHOWOTHER 1
| table Subsidiary  "Technical Dept" LOB Critical High Medium Low Nominal None ALL

tkwaller_2
Communicator

For the win!

That was it. For some reason I didn't think about tabling again. Thanks again!

0 Karma

DalJeanis
Legend

@tkwaller_2 - if your issue has been solved, please accept the answer that solved it. Feel free to upvote any answers or comments that you found particularly helpful as well, on your own or other people's questions.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...