Show a particular column as the last column always

[jiaqya]

i have a table as below.

one two three four total five six

i want the "total" column to be shown at the end always, like below, need help to do this..

one two three four five six total.

also note that the column names are dynamic and can change, but "total" column name remains the same..

[jpolvino]

Another way to do it:

| makeresults | fields - _time
| eval a=1,b=2,c=3,d=4
| eval Total=a+b+c
| table * Total

Using the table command, you can force the field order. In this example, it is saying "list all the fields but put Total at the end."

a   b   c   d   Total
1   2   3   4   6

[jiaqya]

did this using below:

|search query
|rename total as T
|eval total=T
|fields - T

this ends up the column total at the end, right most ..

[jiaqya]

did this using below:

|search query
|rename total as T
|eval total=T
|fields - T

this ends up the column total at the end, right most ..