Splunk Search

Sort based on first count generated by xyseries dynamically

k_harini
Communicator

I want to sort based on the 2nd column generated dynamically post using xyseries command
index="aof_mywizard_deploy_idx" sourcetype="aof_tm_source" | rename "Timelines_FY17 FY18_Q1" as "Completetion_date" |eval c_status=upper('Current Week Status') |search c_status!="TBC"| stats count(c_status) as count by Completetion_date c_status |eventstats sum(count) as Total by Completetion_date| eval ragcount% = (round((count/Total)100))."%"| xyseries c_status Completetion_date count ragcount%|rename "count: *" as ":Count" "ragcount%: " as ":Percent%" |table c_status *|rename c_status as "RAG STATUS"

Columns generated are Rag status, FY17:Count FY17:percent% Fy18-Q1:count.. etc. I want to sort with the first count (in this case FY17:Count) . How can i do that? can some one please help? if i give sort - "FY17:Count" it works.. but since its dynamically generated , is there a way to handle this?

0 Karma

Sukisen1981
Champion

Hi - You can use the value of another field as the name of the destination field by using curly brackets, { }. For example, if you have an event with the following fields, aName=counter and aValue=1234. Use | eval {aName}=aValue to return counter=1234.

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Eval

Add a dynamic eval |eval {xxxx}=value, then | sort -eval {xxxx}

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...