Splunk Search

How to sort dynamic column names by time?


For a data set like this:

stage=Cstage1 status=h1_status1 host=host1 _time=time1
stage=Astage2 status=h1_status2 host=host1 _time=time2
stage=Bstage3 status=h1_status3 host=host1 _time=time3

I would like to report to something like this:

host      Cstage1     Astage2     Bstage3
host1    h1_status1  h1_status2  h1_status3
host2    h2_status1  h2_status2  h2_status3

It is important that those column names be sorted by time order. If I use xyseries or chart commands, they list dynamic column names by alphabetic order, i.e.,

host      Astage2     Bstage3     Cstage2
host1    h1_status2  h1_status3  h1_status2
host2    h2_status2  h2_status3  h2_status2

which looks plain weird and incomprehensible.

So far I can only achieve my desired order by manually adding a numeric prefix like

| eval stage=case(stage="Cstage1", "1-Cstage1", stage="Astage2", "2-Astage2", stage="Bstage3", "3-Bstage3")

Alternatively, I can use eval {stage} like

| eval {stage} = status
| stats list(Cstage1) list(Astage2) list(Bstage3) by host

This is hard and only work in limited cases. (In the past, I probably used some eval + string tricks to work with more "stages". Still awkward nonetheless.)

What is the "proper" way to persuade xyseries or chart to do what I wanted?

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...