Hi,
I am looking to sort column with specific condition.
Condition:
if column Context_Command contains * it should be down in list and all the rows which doesn't have * in Context_Command
should be up in the list.
Try adding this to your search:
...
|eval has_star=if(match(Context_Command, "\*"), 1, 0)
|sort has_star, Context_Command
|fields - has_star
Here is a run-anywhere example:
| makeresults
| eval foo="I have a *"
| eval has_star=if(match(foo, "\*"), 1, 0)
| append
[| makeresults
| eval foo="I don't have a star"
| eval has_star=if(match(foo, "\*"), 1, 0)]
| sort has_star, foo
| fields - has_star
Note that you have to use the match
command because regular expressions are the only way to match a literal wildcard. You probably already figured out that Context_Command="*"
doesn't work.
Try something like this:
| rex field=Context_Command "(?<sortingVariable>\*)"
| table Context_Command sortingVariable
| fillnull
| sort -sortingVariable
Add whatever additional fields you want to the table commands, and it should work,
I tested it with this query:
| makeresults
| eval Context_Command="*,*,23,1123*23,4224,232*2,1111,***1"
| makemv Context_Command delim=","
| fields Context_Command
| stats count by Context_Command
| rex field=Context_Command "(?<sortingVariable>\*)"
| table Context_Command sortingVariable
| fillnull
| sort -sortingVariable
Try adding this to your search:
...
|eval has_star=if(match(Context_Command, "\*"), 1, 0)
|sort has_star, Context_Command
|fields - has_star
Here is a run-anywhere example:
| makeresults
| eval foo="I have a *"
| eval has_star=if(match(foo, "\*"), 1, 0)
| append
[| makeresults
| eval foo="I don't have a star"
| eval has_star=if(match(foo, "\*"), 1, 0)]
| sort has_star, foo
| fields - has_star
Note that you have to use the match
command because regular expressions are the only way to match a literal wildcard. You probably already figured out that Context_Command="*"
doesn't work.