Splunk Search

How to sort dynamic column names by time?


For a data set like this:

stage=Cstage1 status=h1_status1 host=host1 _time=time1
stage=Astage2 status=h1_status2 host=host1 _time=time2
stage=Bstage3 status=h1_status3 host=host1 _time=time3

I would like to report to something like this:

host      Cstage1     Astage2     Bstage3
host1    h1_status1  h1_status2  h1_status3
host2    h2_status1  h2_status2  h2_status3

It is important that those column names be sorted by time order. If I use xyseries or chart commands, they list dynamic column names by alphabetic order, i.e.,

host      Astage2     Bstage3     Cstage2
host1    h1_status2  h1_status3  h1_status2
host2    h2_status2  h2_status3  h2_status2

which looks plain weird and incomprehensible.

So far I can only achieve my desired order by manually adding a numeric prefix like

| eval stage=case(stage="Cstage1", "1-Cstage1", stage="Astage2", "2-Astage2", stage="Bstage3", "3-Bstage3")

Alternatively, I can use eval {stage} like

| eval {stage} = status
| stats list(Cstage1) list(Astage2) list(Bstage3) by host

This is hard and only work in limited cases. (In the past, I probably used some eval + string tricks to work with more "stages". Still awkward nonetheless.)

What is the "proper" way to persuade xyseries or chart to do what I wanted?

0 Karma