Thanks for helping !!! . Found a way with eval as you guys suggested , with a combination of case().
eval Sort_SOR_NM=lower(SOR_NM) | eval sort_field=case(Sort_SOR_NM=="HOMES",1, Sort_SOR_NM=="STUCK",2, Sort_SOR_NM=="CCD",3, Sort_SOR_NM=="GCIPUR",4, Sort_SOR_NM=="TABLE",5) | sort sort_field
This worked 🙂
if you dont have many fields, you can add eval statements and give value to a new field and then sort it
I don't think there is any option to change the chronological sorting. Also there is not setting to make it sort based on the search filter specified. You can try workarounds to do your custom sort.
| multisearch [search SOR_NM=HOME| eval order=1][search STUCK | eval order=2][search CCD | order=3][search GCIPUR | eval order=4][search TABLE | order=5] | sort order | table SOR_NM AS_OF_DT STATUS
Yes Ayn, I understand that . The point here is , I expect my output to be in the order I mentioned in the search query (SOR_NM=HOME OR STUCK OR CCD OR GCIPUR OR TABLE) . Not in any other chronological order .
Expected Result is shown below :
SOR_NM AS_OF_DT STATUS
HOME 2013/11/05 COMPL
STUCK 2013/11/05 COMPL
CCD 2013/11/05 COMPL
GCIPUR 2013/11/05 InProgress
TABLE 2013/11/05 InProgress
The output is in reverse chronological order unless you specify otherwise.
I search with the below Query (Incomplete) and get the corresponding sample output as tabulated.
SOR_NM=HOME OR STUCK OR CCD OR GCIPUR OR TABLE | table SOR_NM AS_OF_DT STATUS
SOR_NM AS_OF_DT STATUS
CCD 2013/11/05 COMPL
GCIPUR 2013/11/05 InProgress
HOME 2013/11/05 COMPL
STUCK 2013/11/05 COMPL
TABLE 2013/11/05 InProgress
The ouput is being sort automatically in alphabetical order at SOR_NM. All I need is , an output with the SOR_NM in the order I give in search with its corresponding values(AS_OF_DT and STATUS). Can this be done ?
Where is the problem, index it and make a table