Splunk Search

Show a particular column as the last column always

jiaqya
Builder

i have a table as below.

one two three four total five six

i want the "total" column to be shown at the end always, like below, need help to do this..

one two three four five six total.

also note that the column names are dynamic and can change, but "total" column name remains the same..

Tags (1)
0 Karma

jpolvino
Builder

Another way to do it:

| makeresults | fields - _time
| eval a=1,b=2,c=3,d=4
| eval Total=a+b+c
| table * Total

Using the table command, you can force the field order. In this example, it is saying "list all the fields but put Total at the end."

a   b   c   d   Total
1   2   3   4   6

jiaqya
Builder

did this using below:

|search query
|rename total as T
|eval total=T
|fields - T

this ends up the column total at the end, right most ..

0 Karma

jiaqya
Builder

did this using below:

|search query
|rename total as T
|eval total=T
|fields - T

this ends up the column total at the end, right most ..

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...