Splunk Search

Sort based on first count generated by xyseries dynamically


I want to sort based on the 2nd column generated dynamically post using xyseries command
index="aofmywizarddeployidx" sourcetype="aoftmsource" | rename "TimelinesFY17 FY18Q1" as "Completetiondate" |eval cstatus=upper('Current Week Status') |search cstatus!="TBC"| stats count(cstatus) as count by Completetiondate cstatus |eventstats sum(count) as Total by Completetiondate| eval ragcount% = (round((count/Total)100))."%"| xyseries cstatus Completetiondate count ragcount%|rename "count: *" as ":Count" "ragcount%: " as ":Percent%" |table cstatus *|rename cstatus as "RAG STATUS"

Columns generated are Rag status, FY17:Count FY17:percent% Fy18-Q1:count.. etc. I want to sort with the first count (in this case FY17:Count) . How can i do that? can some one please help? if i give sort - "FY17:Count" it works.. but since its dynamically generated , is there a way to handle this?

0 Karma

Re: Sort based on first count generated by xyseries dynamically


Hi - You can use the value of another field as the name of the destination field by using curly brackets, { }. For example, if you have an event with the following fields, aName=counter and aValue=1234. Use | eval {aName}=aValue to return counter=1234.


Add a dynamic eval |eval {xxxx}=value, then | sort -eval {xxxx}

0 Karma