How to edit position of column in statistic cable?

[jialiu907]

I am looking to have the middle row of this table be in the left instead. I think something in the query is off and causing it to have a weird behavior. 

index=main host=* sourcetype=syslog process=elcsend "\"config" $city$
| rex "([^!]*!){16}(?P<MEMGB>[^!]*)!"
| chart count by MEMGB
| addcoltotals label=Total labelfield=MEMGB
| sort count desc

This is the current search query. The rex provides the data in the MEMGB column.

[richgalloway]

Please clarify the request.  There are 10 rows displayed so there is no middle one.  Not that it matters since there is no left/right orientation for (horizontal) rows.  If you are referring to the columns, then again I ask for clarification since there is no middle column when there are only 2 of them.

That said, if you want to put the "Total" value at the bottom, put the addcoltotals command after the sort.

[jialiu907]

Sorry for the confusion, I can clarify. I am looking for the left column in the picture to be in the left-most area where it is typically located when using the stats/chart count by command and not in the middle of the overall table.

Similar to the CPUMFR column in picture above.

[ITWhisperer · Accepted solution]

Numeric fields are right-aligned, string fields are left-aligned so convert your MEMGB field values to strings and add a trailing space

index=main host=* sourcetype=syslog process=elcsend "\"config" $city$
| rex "([^!]*!){16}(?P<MEMGB>[^!]*)!"
| chart count by MEMGB
| addcoltotals label=Total labelfield=MEMGB
| eval MEMGB=tostring(MEMGB)." "
| sort count desc

[jialiu907]

Thanks for the new knowledge. That is what I was looking for