I am using a search cloned from the SoS app. I modified it to sort in the search itself. Though the search does run on my dashboard, it doesn't sort the table using the sort I have at the end of the saved search. Is there a way to specify the sort field in the simple XML?
Just edited it for ya @dolfantimmy You might want to include the search you're using and how you want the resulting table to display for search gurus to better assist you.
Please ensure your search doesn't contains any macro's / eventtypes which is created by the SoS.
Most of the SoS application search string contains macro's those are with permission "in app" so probably you need to change the permission to global.
I tried locally its working fine. could you please share the exact query what you are cloned from SoS.
Slightly modified from sos, here's the search. It run great in the search app. And does display data on my dashboard, but the data is not sorted when shown on the dashboard.
(host="sp3ctxqs01" OR splunkserver=local) action=search (id=* OR searchid=)
| eval searchid=if(isnull(searchid), id, search_id)
| replace '' with * in searchid
| search searchid!=rt* searchid!=searchparsetmp*
| rex "search='(?
| rex "savedsearchname=\"(?<savedsearchname>.?)\"]["
| eval search=case(isnotnull(search),search,isnull(search) AND savedsearchname!="","Scheduled search name : ".savedsearchname,isnull(search) AND savedsearchname=="","SID : ".searchid)
| convert num(totalruntime)
| eval user = if(user="n/a", "nobody", user)
| stats min(time) as _time last(user) as user max(totalruntime) as totalruntime last(search) as search by searchid | search searchid=* search!=typeahead* search!="|history" search!=internal* search!=_audit|sort -totalruntime
Is there a missing space between the minus sign and the field name?? Shouldn´t it be:
... |sort - total_run_time
Thanks gfuente, I tried that with the same results. The dashboard still displays sorted by event time, not by totalruntime.