Splunk Search

Sort based on first count generated by xyseries dynamically

k_harini
Communicator

I want to sort based on the 2nd column generated dynamically post using xyseries command
index="aof_mywizard_deploy_idx" sourcetype="aof_tm_source" | rename "Timelines_FY17 FY18_Q1" as "Completetion_date" |eval c_status=upper('Current Week Status') |search c_status!="TBC"| stats count(c_status) as count by Completetion_date c_status |eventstats sum(count) as Total by Completetion_date| eval ragcount% = (round((count/Total)100))."%"| xyseries c_status Completetion_date count ragcount%|rename "count: *" as ":Count" "ragcount%: " as ":Percent%" |table c_status *|rename c_status as "RAG STATUS"

Columns generated are Rag status, FY17:Count FY17:percent% Fy18-Q1:count.. etc. I want to sort with the first count (in this case FY17:Count) . How can i do that? can some one please help? if i give sort - "FY17:Count" it works.. but since its dynamically generated , is there a way to handle this?

0 Karma

Sukisen1981
Champion

Hi - You can use the value of another field as the name of the destination field by using curly brackets, { }. For example, if you have an event with the following fields, aName=counter and aValue=1234. Use | eval {aName}=aValue to return counter=1234.

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Eval

Add a dynamic eval |eval {xxxx}=value, then | sort -eval {xxxx}

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...

Build and Launch AI Agents from Your Splunk Workflows

  Register We’ve all been there: juggling alerts, runbooks, and endless manual searches. What if you could ...

Splunk Cloud Application Management in Terraform

Register   On Tuesday, August 4 at 11AM PDT / 2PM EDT, we’re diving into how you can bring Infrastructure as ...