Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to sort chart columns where the column headers...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have the following search.
index=ko_autosys sourcetype=autosys_applog_scheduler_events host="usatlb98" OR host="usatlb91" System="*" JOB_NAME="*" eventtype=autosys_failure_jobs OR eventtype=autosys_terminated_jobs OR eventtype=autosys_restart_jobs OR eventtype=autosys_success_jobs |chart count(JOB_NAME) over System by job_status
It displays a table with the following columns: System, FAILURE, RESTART, TERMINATED, SUCCESS
I want to sort by the FAILURE Column where the System with the largest number of failures is on top. The issue is that FAILURE SUCCESS TERMINATED and RESTART are field values, not field names.
Please help. Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Assuming that FAILURE is a value of field job_status then your statement is incorrect. Using chart the way you show will cause a column (field) to be created named FAILURE so you should be able to do it like this:
index=ko_autosys sourcetype=autosys_applog_scheduler_events host="usatlb98" OR host="usatlb91" System="*" JOB_NAME="*" eventtype=autosys_failure_jobs OR eventtype=autosys_terminated_jobs OR eventtype=autosys_restart_jobs OR eventtype=autosys_success_jobs | chart count(JOB_NAME) over System by job_status | sort 0 -FAILURE
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Assuming that FAILURE is a value of field job_status then your statement is incorrect. Using chart the way you show will cause a column (field) to be created named FAILURE so you should be able to do it like this:
index=ko_autosys sourcetype=autosys_applog_scheduler_events host="usatlb98" OR host="usatlb91" System="*" JOB_NAME="*" eventtype=autosys_failure_jobs OR eventtype=autosys_terminated_jobs OR eventtype=autosys_restart_jobs OR eventtype=autosys_success_jobs | chart count(JOB_NAME) over System by job_status | sort 0 -FAILURE
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
