Splunk Search
Highlighted

Sort table in a specific order? Sample from Splunk does not work?

Path Finder

Sample given from Splunk:

   ... | eval wd=lower(Day) | eval sort_field=case(wd=="monday",1, wd=="tuesday",2, wd=="wednesday",3, wd=="thursday",4, wd=="friday",5, wd=="weekend",6) | sort sort_field | fields - sort_field

Mine:

index=myindex sourcetype=mysourcetype vendor=myvendor   | eval sort_killchain=case(cat=="BOTNET ACTIVITY",1,cat=="COMMAND & CONTROL",2,cat=="RECONNAISSANCE",3,cat=="LATERAL MOVEMENT",4,cat=="EXFILTRATION",5) |stats count by cat |where cat=="COMMAND & CONTROL" OR cat=="RECONNAISSANCE" OR cat=="LATERAL MOVEMENT" OR cat=="BOTNET ACTIVITY" OR cat=="EXFILTRATION" | sort by sort_killchain

Any reason why mine shouldn't work?

0 Karma
Highlighted

Re: Sort table in a specific order? Sample from Splunk does not work?

SplunkTrust
SplunkTrust

Add your sortkillchain after the stats command. The filed sortkillchain is NOT referred in stats and hence the output of stats has only cat and count.

index=myindex sourcetype=mysourcetype vendor=myvendor |stats count by cat 
| eval sort_killchain=case(cat=="BOTNET ACTIVITY",1,cat=="COMMAND & CONTROL",2,cat=="RECONNAISSANCE",3,cat=="LATERAL MOVEMENT",4,cat=="EXFILTRATION",5) 
|where cat=="COMMAND & CONTROL" OR cat=="RECONNAISSANCE" OR cat=="LATERAL MOVEMENT" OR cat=="BOTNET ACTIVITY" OR cat=="EXFILTRATION" | sort by sort_killchain

View solution in original post