How to position a value in table in the last column?

[vvemula]

I have result like this, 

parameter	compliance	non-compliance
64bit	43	22
Bios	24	41
Error	0	65
Inter	64	1
OS	61	4

And I want Error to be displayed in the last column, Like below:

parameter	compliance	non-compliance
64bit	43	22
Bios	24	41
Inter	64	1
OS	61	4
Error	0	65

is it something possible in Splunk without CSS or JS. 

[vvemula]

@gcusello  Thanks for the help. But its not working. 

--> As per your search, after modify the Error to "zzz_Error", Its coming in the last row. But once I use eval to change from "zzz_Error" to Error. Its going back to the original position again. 

[gcusello]

Hi @vvemula,

did you respected the order of commands: eval, chart, eval?

in my Splunk it runs:

Ciao.

Giuseppe

[gcusello]

Hi @vvemula,

you have to temporary modify Error value to be sure that it's the last one and, at the end, restore the original value, something like this:

your_search
| eval parameter=if(parameter="Error","ZZZZ_Error",parameter)
| chart count over status BY parameter
| eval parameter=if(parameter="ZZZZ_Error","Error",parameter)

Ciao.

Giuseppe