Splunk Search

How to change the order of dynamic columns based on count?

splunk24
Path Finder

There is a requirement to change the order of columns on the basis of count.
for eg.
A B C D
4 2 1 3

output should be:
C B D A
1 2 3 4

Constraints:
We don't know the column names, so we can't use table C B D A

0 Karma

sundareshr
Legend

Here's a similar question with an answer. See if that will work for you

https://answers.splunk.com/answers/89367/table-sort-columns-numerically.html

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...