Splunk Search

How to sort dynamic column names by time?


For a data set like this:

stage=Cstage1 status=h1_status1 host=host1 _time=time1
stage=Astage2 status=h1_status2 host=host1 _time=time2
stage=Bstage3 status=h1_status3 host=host1 _time=time3

I would like to report to something like this:

host      Cstage1     Astage2     Bstage3
host1    h1_status1  h1_status2  h1_status3
host2    h2_status1  h2_status2  h2_status3

It is important that those column names be sorted by time order. If I use xyseries or chart commands, they list dynamic column names by alphabetic order, i.e.,

host      Astage2     Bstage3     Cstage2
host1    h1_status2  h1_status3  h1_status2
host2    h2_status2  h2_status3  h2_status2

which looks plain weird and incomprehensible.

So far I can only achieve my desired order by manually adding a numeric prefix like

| eval stage=case(stage="Cstage1", "1-Cstage1", stage="Astage2", "2-Astage2", stage="Bstage3", "3-Bstage3")

Alternatively, I can use eval {stage} like

| eval {stage} = status
| stats list(Cstage1) list(Astage2) list(Bstage3) by host

This is hard and only work in limited cases. (In the past, I probably used some eval + string tricks to work with more "stages". Still awkward nonetheless.)

What is the "proper" way to persuade xyseries or chart to do what I wanted?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...