Splunk Search

Sort fieldnames

Explorer

AccountName FAILURE SUCCESS IMPACT LOSS% Total

Account120001490.111.3310804
Account220812620.109.552043
Account3163015540.019.491017

 

Output was from inner join

I want the output like - alignment of field names. Sorting the order of field names.

Before - 

AccountName    FAILURE SUCCESS  IMPACT LOSS% Total 

 

After sorting  should be -

 

AccountName    FAILURE SUCCESS Total   IMPACT LOSS%

Labels (3)
0 Karma
1 Solution

SplunkTrust
SplunkTrust
The table command is the one to use to re-order fields for display.
Please share your query so we can see what may be throwing things off.
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SplunkTrust
SplunkTrust

Use the table command to specify the order in which fields should be displayed.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Explorer

@richgalloway I have used table in second query and chart in first. I am not getting the desired result.

0 Karma

SplunkTrust
SplunkTrust
The table command is the one to use to re-order fields for display.
Please share your query so we can see what may be throwing things off.
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Ultra Champion
index=_internal 
| head 3 
| fields _raw _time 
| streamstats count 
| eval _raw=case(count=1,"AccountName=Account1,FAILURE=2000,SUCCESS=149,IMPACT=0.1,LOSS%=11.33,Total=10804",count=2,"AccountName=Account2,FAILURE=2081,SUCCESS=262,IMPACT=0.10,LOSS%=9.55,Total=2043"
    ,count=3,"AccountName=Account3,FAILURE=1630,SUCCESS=1554,IMPACT=0.01,LOSS%=9.49,Total=1017") 
| fields - count 
| kv 
| rename LOSS as "LOSS%" 
| table AccountName FAILURE SUCCESS Total IMPACT LOSS%

I'm not sure when it can't table.

 

0 Karma

Explorer

@to4kawa  I have mutliple Account_NM which will be generated in realtime. The ACCOUNT_NM which I provided was sample data.

Thank you for the info though 🙂

0 Karma