Sorting of Columns in Saved Search

[ppurokit]

Hello everyone,

I have a table like the below example:

|| Protocol || Count ||

|| TCP || 500 ||

|| UDP || 200 ||

|| Total || 700 ||

I have made use of the addcoltotals to get the total count of the count column.

So now when I click on the default column sorting available , it's sorting taking into account the "Total" row also and hence the sorting is not perfect.

Is there a way in which i can make the "Total" row fixed and sort only the rows which are fetched from the search query?

[rturk]

Hi Ppurokit,

Once you apply addcoltotals Splunk treats the newly added information as a new row along with the rest of them.. as far as I know there's no way around this.

If you are looking to put this in a static dashboard, or in a emailed report however, applying the sort before adding the column totals will ensure that your table is sorted as required with the totals down the bottom.

<base search> | sort -count | addcoltotals

NOTE: Selecting to sort the columns by clicking the headers will break this behaviour, and you will need to refresh the browser window (not just re-submit the search).