Splunk Search

How to change the order of display of column in stats which is grouped by "count by"?

manimuthu
Loves-to-Learn Everything

Hi all,

My query has,

.... | stats latest(time) as recent_event,latest(key) as recent_key, count by field1,field2

and the output has columns (order) like

field1  field2  recent_event   recent_key  count

(where count is obtained because of "count by")

Is it possible to change the order of the columns

recent_event      count       field1       recent_key      field2   

Labels (2)
0 Karma

manimuthu
Loves-to-Learn Everything

sorry i am totally new to splunk. the number of seach result differs before and after adding 

 

| table recent_event count field1 recent_key field2  

by using "count by " the events are grouped based on field1 & field2 (is my understanding correct) and the count of each group is displayed by default under count column.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @manimuthu,

this isn't possible, probably you're analyzing data from different time frames, if you analyze data e.g. of yesterday or one hour ago (in other words: until now), you'll have the same results, because the row I hinted to add doesn't change the results.

Anyway, yes, the stats command groups data by the two fields and gives the result in the count column.

For your knowledge, I hint to follow the Splunk Search Tutorial, to better understand how Splunk works https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial/WelcometotheSearchTutorial

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @manimuthu,

at the end of your search you have to add a table command, something like this:

Your_search
| stats latest(time) as recent_event,latest(key) as recent_key, count by field1 field2
| table recent_event count field1 recent_key field2   

Ciao.

Giuseppe

0 Karma

manimuthu
Loves-to-Learn Everything

Thanks for replying but its not working for me

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @manimuthu,

Why it isn't working for you, what's the limitation?

The only other option is to insert a row like this in the panel visualizing the search results:

<fields>recent_event,count,field1,recent_key,field2</fields>

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...