Splunk Search
Highlighted

Ordering Columns Not Working

Communicator

http://splunk-base.splunk.com/answers/49712/can-we-sort-command-for-sorting-the-table-records-rowwis...

Hi All,

I have a column chart and want to order the columns. The above link isn't quite what I am looking for. My search query is as follows, and works all apart from I'd like it ordering.

host="*90*" FeedSource | search Fixture>0 | stats max(_time) As LatestTime By Action | eval Gap=time()-LatestTime | chart last(Gap) by Action`

How can I order the fields such as CACHEINSERT CACHEUPDATE etc?

Many thanks in advance.

0 Karma
Highlighted

Re: Ordering Columns Not Working

Legend

I am not sure this will work, but try putting the table command at the end of your search, listing the fields in the order that you want them to appear. Be sure to list them all!

host="*90*" FeedSource Fixture>0 
| stats max(_time) As LatestTime By Action 
| eval Gap=time()-LatestTime 
| chart last(Gap) as lastGap by Action
| table CACHE_INSERT CACHE_UPDATE

I do see some problems with this. First time() is the current wall clock time - even if you want the "current" time, I would use now(). now() is when the search began, and so it will be consistent for all events in this search. But time() will vary based on how long this search takes to run.

The second problem is that your table command must list all the values of Action. If these change, then your search must be updated.

View solution in original post

0 Karma
Highlighted

Re: Ordering Columns Not Working

Communicator

Thanks, seems to have had the same effect as in the link I posted in my question. Also using now() in a real-time search causes the results to gradually move into greater negative values.

0 Karma
Highlighted

Re: Ordering Columns Not Working

Legend

Sorry - didn't know this was a RT search - then time() IS a better choice.

0 Karma
Highlighted

Re: Ordering Columns Not Working

Legend

Would it make sense to use the stats command instead of the chart command?

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.