How to change the order of display of column in stats which is grouped by "count by"?

[manimuthu]

Hi all,

My query has,

.... | stats latest(time) as recent_event,latest(key) as recent_key, count by field1,field2

and the output has columns (order) like

field1  field2  recent_event   recent_key  count

(where count is obtained because of "count by")

Is it possible to change the order of the columns

recent_event      count       field1       recent_key      field2   

[manimuthu]

sorry i am totally new to splunk. the number of seach result differs before and after adding 

| table recent_event count field1 recent_key field2  

by using "count by " the events are grouped based on field1 & field2 (is my understanding correct) and the count of each group is displayed by default under count column.

[gcusello]

Hi @manimuthu,

this isn't possible, probably you're analyzing data from different time frames, if you analyze data e.g. of yesterday or one hour ago (in other words: until now), you'll have the same results, because the row I hinted to add doesn't change the results.

Anyway, yes, the stats command groups data by the two fields and gives the result in the count column.

For your knowledge, I hint to follow the Splunk Search Tutorial, to better understand how Splunk works https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial/WelcometotheSearchTutorial

Ciao.

Giuseppe

[gcusello]

Hi @manimuthu,

at the end of your search you have to add a table command, something like this:

Your_search
| stats latest(time) as recent_event,latest(key) as recent_key, count by field1 field2
| table recent_event count field1 recent_key field2   

Ciao.

Giuseppe

[manimuthu]

Thanks for replying but its not working for me

[gcusello]

Hi @manimuthu,

Why it isn't working for you, what's the limitation?

The only other option is to insert a row like this in the panel visualizing the search results:

<fields>recent_event,count,field1,recent_key,field2</fields>

Ciao.

Giuseppe