Splunk Search

Reordering fields

mnj1809
Path Finder

Hello Splunkers,

I've a Region filter over the dashboard. This Region filter has values AMER and EMEA.

 

mnj1809_0-1705319723804.png

I've a requirement to reorder the above fields based on the selection of Region filter as follows. I want "<Region> Mandatory" field to be appear before "<Region> All"

mnj1809_1-1705320516370.png

Thanks in advance.

@tscroggins @yuanliu @bowesmana 

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try putting an extra space before Mandatory so that lexicographical sorting will prioritise above single spaced values

| foreach "* Mandatory"
    [| rename "<<FIELD>>" as "<<MATCHSEG1>>  Mandatory"]

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try putting an extra space before Mandatory so that lexicographical sorting will prioritise above single spaced values

| foreach "* Mandatory"
    [| rename "<<FIELD>>" as "<<MATCHSEG1>>  Mandatory"]
0 Karma

mnj1809
Path Finder

Thanks @ITWhisperer. It work like a charm.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mnj1809,

could you share your search and the possible values for regions in text mode?

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...