Splunk Search

How can I sort the split columns in this pivot?

tkwaller_2
Communicator

Hello

I have a dataset that I created along with a pivot table. the table has a split column called RR_Score which is an eval field in the dataset. This field evals a field called score and creates criticality as Critical, High, Medium, Low, Nominal and None. I want it sorted in that order specifically BUT I cannot do that, it only sorts alphabetically. I tried eval'ing a new field called
sortingSequence that does this:

case(RR_Score="Critical", 1, RR_Score="High", 2, RR_Score="Medium", 3, RR_Score="Low", 4, RR_Score="Nominal", 5, RR_Score="None", 6,1=1, 0)

However it doesn't sort in regular search nor in pivot, I don't want to display the field either. just want to order the RR_Score fields.

The search looks something like this:

| pivot RiskEvalData RiskEvalData count(info_name) AS "Count of Vendor" SPLITROW info_owner_subsidiary AS Subsidiary SPLITROW info_owner_deptTechnical AS "Technical Dept" SPLITROW info_owner_deptBusiness AS LOB SPLITCOL RR_Score SORT 1000 sortingSequence ROWSUMMARY 1 COLSUMMARY 1 NUMCOLS 100 SHOWOTHER 1

I have attached a screenshot of the pivot table.
alt text

Any thought how I can get the RR_Score fields sorted properly?
Thanks as always!

0 Karma
1 Solution

somesoni2
Revered Legend

You can try thi, If the values for field RR_Score are fixed and you always want all columns to be present.

| pivot RiskEvalData RiskEvalData count(info_name) AS "Count of Vendor" SPLITROW info_owner_subsidiary AS Subsidiary SPLITROW info_owner_deptTechnical AS "Technical Dept" SPLITROW info_owner_deptBusiness AS LOB SPLITCOL RR_Score SORT 1000 sortingSequence ROWSUMMARY 1 COLSUMMARY 1 NUMCOLS 100 SHOWOTHER 1
| table Subsidiary  "Technical Dept" LOB Critical High Medium Low Nominal None ALL

View solution in original post

somesoni2
Revered Legend

You can try thi, If the values for field RR_Score are fixed and you always want all columns to be present.

| pivot RiskEvalData RiskEvalData count(info_name) AS "Count of Vendor" SPLITROW info_owner_subsidiary AS Subsidiary SPLITROW info_owner_deptTechnical AS "Technical Dept" SPLITROW info_owner_deptBusiness AS LOB SPLITCOL RR_Score SORT 1000 sortingSequence ROWSUMMARY 1 COLSUMMARY 1 NUMCOLS 100 SHOWOTHER 1
| table Subsidiary  "Technical Dept" LOB Critical High Medium Low Nominal None ALL

tkwaller_2
Communicator

For the win!

That was it. For some reason I didn't think about tabling again. Thanks again!

0 Karma

DalJeanis
Legend

@tkwaller_2 - if your issue has been solved, please accept the answer that solved it. Feel free to upvote any answers or comments that you found particularly helpful as well, on your own or other people's questions.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Thanks for the Memories! Splunk University, .conf25, and our Community

Thank you to everyone in the Splunk Community who joined us for .conf25, which kicked off with our iconic ...