Sort table in a specific order? Sample from Splunk does not work?

[alex1895]

Sample given from Splunk:

   ... | eval wd=lower(Day) | eval sort_field=case(wd=="monday",1, wd=="tuesday",2, wd=="wednesday",3, wd=="thursday",4, wd=="friday",5, wd=="weekend",6) | sort sort_field | fields - sort_field

Mine:

index=myindex sourcetype=mysourcetype vendor=myvendor   | eval sort_killchain=case(cat=="BOTNET ACTIVITY",1,cat=="COMMAND & CONTROL",2,cat=="RECONNAISSANCE",3,cat=="LATERAL MOVEMENT",4,cat=="EXFILTRATION",5) |stats count by cat |where cat=="COMMAND & CONTROL" OR cat=="RECONNAISSANCE" OR cat=="LATERAL MOVEMENT" OR cat=="BOTNET ACTIVITY" OR cat=="EXFILTRATION" | sort by sort_killchain

Any reason why mine shouldn't work?

[renjith_nair · Accepted solution]

Add your sort_killchain after the stats command. The filed sort_killchain is NOT referred in stats and hence the output of stats has only cat and count.

index=myindex sourcetype=mysourcetype vendor=myvendor |stats count by cat 
| eval sort_killchain=case(cat=="BOTNET ACTIVITY",1,cat=="COMMAND & CONTROL",2,cat=="RECONNAISSANCE",3,cat=="LATERAL MOVEMENT",4,cat=="EXFILTRATION",5) 
|where cat=="COMMAND & CONTROL" OR cat=="RECONNAISSANCE" OR cat=="LATERAL MOVEMENT" OR cat=="BOTNET ACTIVITY" OR cat=="EXFILTRATION" | sort by sort_killchain