How to customize and sort columns with specific conditions?

[AKG1_old1]

Hi,

I am looking to sort column with specific condition.

Condition:
if column Context_Command contains * it should be down in list and all the rows which doesn't have * in Context_Command
should be up in the list.

[martinpu]

Try something like this:

  | rex field=Context_Command "(?<sortingVariable>\*)"
| table Context_Command sortingVariable 
| fillnull
| sort -sortingVariable

Add whatever additional fields you want to the table commands, and it should work,
I tested it with this query:

| makeresults 
| eval Context_Command="*,*,23,1123*23,4224,232*2,1111,***1" 
| makemv Context_Command delim=","
| fields Context_Command
| stats count by Context_Command
| rex field=Context_Command "(?<sortingVariable>\*)"
| table Context_Command sortingVariable 
| fillnull
| sort -sortingVariable

[grittonc · Accepted solution]

Try adding this to your search:

...
|eval has_star=if(match(Context_Command, "\*"), 1, 0)
|sort has_star, Context_Command 
|fields - has_star

Here is a run-anywhere example:

| makeresults 
| eval foo="I have a *" 
| eval has_star=if(match(foo, "\*"), 1, 0) 
| append 
    [| makeresults 
    | eval foo="I don't have a star" 
    | eval has_star=if(match(foo, "\*"), 1, 0)] 
| sort has_star, foo
| fields - has_star

Note that you have to use the match command because regular expressions are the only way to match a literal wildcard. You probably already figured out that Context_Command="*" doesn't work.