Splunk Search

How can I sort the split columns in this pivot?

tkwaller_2
Communicator

Hello

I have a dataset that I created along with a pivot table. the table has a split column called RR_Score which is an eval field in the dataset. This field evals a field called score and creates criticality as Critical, High, Medium, Low, Nominal and None. I want it sorted in that order specifically BUT I cannot do that, it only sorts alphabetically. I tried eval'ing a new field called
sortingSequence that does this:

case(RR_Score="Critical", 1, RR_Score="High", 2, RR_Score="Medium", 3, RR_Score="Low", 4, RR_Score="Nominal", 5, RR_Score="None", 6,1=1, 0)

However it doesn't sort in regular search nor in pivot, I don't want to display the field either. just want to order the RR_Score fields.

The search looks something like this:

| pivot RiskEvalData RiskEvalData count(info_name) AS "Count of Vendor" SPLITROW info_owner_subsidiary AS Subsidiary SPLITROW info_owner_deptTechnical AS "Technical Dept" SPLITROW info_owner_deptBusiness AS LOB SPLITCOL RR_Score SORT 1000 sortingSequence ROWSUMMARY 1 COLSUMMARY 1 NUMCOLS 100 SHOWOTHER 1

I have attached a screenshot of the pivot table.
alt text

Any thought how I can get the RR_Score fields sorted properly?
Thanks as always!

0 Karma
1 Solution

somesoni2
Revered Legend

You can try thi, If the values for field RR_Score are fixed and you always want all columns to be present.

| pivot RiskEvalData RiskEvalData count(info_name) AS "Count of Vendor" SPLITROW info_owner_subsidiary AS Subsidiary SPLITROW info_owner_deptTechnical AS "Technical Dept" SPLITROW info_owner_deptBusiness AS LOB SPLITCOL RR_Score SORT 1000 sortingSequence ROWSUMMARY 1 COLSUMMARY 1 NUMCOLS 100 SHOWOTHER 1
| table Subsidiary  "Technical Dept" LOB Critical High Medium Low Nominal None ALL

View solution in original post

somesoni2
Revered Legend

You can try thi, If the values for field RR_Score are fixed and you always want all columns to be present.

| pivot RiskEvalData RiskEvalData count(info_name) AS "Count of Vendor" SPLITROW info_owner_subsidiary AS Subsidiary SPLITROW info_owner_deptTechnical AS "Technical Dept" SPLITROW info_owner_deptBusiness AS LOB SPLITCOL RR_Score SORT 1000 sortingSequence ROWSUMMARY 1 COLSUMMARY 1 NUMCOLS 100 SHOWOTHER 1
| table Subsidiary  "Technical Dept" LOB Critical High Medium Low Nominal None ALL

tkwaller_2
Communicator

For the win!

That was it. For some reason I didn't think about tabling again. Thanks again!

0 Karma

DalJeanis
Legend

@tkwaller_2 - if your issue has been solved, please accept the answer that solved it. Feel free to upvote any answers or comments that you found particularly helpful as well, on your own or other people's questions.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...