how to maintain order in stats command

[RSS_STT]

Fields value of 2nd and 3rd events are enter changing. please suggest how to maintain order in Splunk status command. I can't use any other fields in stats by clause than token_id.

Sample Event:

|makeresults
|eval token_id="c75136c4-bdbc-439b"|eval doc_no="GSSAGGOS_QA-2931"|eval key=2931|eval keyword="DK-BAL-AP-00613"
|append [| makeresults |eval token_id="c75136c4-bdbc-439b"|eval doc_no="GSSAGGOS_QA-2932"|eval key=2932|eval keyword="DK-Z13-SW-00002"]
|append [| makeresults |eval token_id="c75136c4-bdbc-439b"|eval doc_no="GSSAGGOS_QA-2933"|eval key=2933|eval keyword="DK-BAL-AP-00847"]
| stats values(key) as key values(keyword) as keyword values(doc_no) as doc_no by token_id
| eval row=mvrange(0,mvcount(doc_no))| mvexpand row| foreach doc_no keyword key
[| eval <<FIELD>>=mvindex(<<FIELD>>,row)]|fields - row

Search Result output
toke_id	key	keyword	doc_no
c75136c4-bdbc-439b	2931	DK-BAL-AP-00613	GSSAGGOS_QA-2931
c75136c4-bdbc-439b	2932	DK-BAL-AP-00847	GSSAGGOS_QA-2932
c75136c4-bdbc-439b	2933	DK-Z13-SW-00002	GSSAGGOS_QA-2933
Expected Output
toke_id	key	keyword	doc_no
c75136c4-bdbc-439b	2931	DK-BAL-AP-00613	GSSAGGOS_QA-2931
c75136c4-bdbc-439b	2932	DK-Z13-SW-00002	GSSAGGOS_QA-2932
c75136c4-bdbc-439b	2933	DK-BAL-AP-00847	GSSAGGOS_QA-2933

[ITWhisperer]

values() sorts (and dedups) - use the list() function (which neither sorts nor dedups)

|makeresults
|eval token_id="c75136c4-bdbc-439b"|eval doc_no="GSSAGGOS_QA-2931"|eval key=2931|eval keyword="DK-BAL-AP-00613"
|append [| makeresults |eval token_id="c75136c4-bdbc-439b"|eval doc_no="GSSAGGOS_QA-2932"|eval key=2932|eval keyword="DK-Z13-SW-00002"]
|append [| makeresults |eval token_id="c75136c4-bdbc-439b"|eval doc_no="GSSAGGOS_QA-2933"|eval key=2933|eval keyword="DK-BAL-AP-00847"]
| stats list(key) as key list(keyword) as keyword list(doc_no) as doc_no by token_id
| eval row=mvrange(0,mvcount(doc_no))| mvexpand row| foreach doc_no keyword key
[| eval <<FIELD>>=mvindex(<<FIELD>>,row)]|fields - row

[richgalloway]

The output of the values and list functions are always in lexicographical order.  That destroys any relationship that might exist between/among fields.

The solution is to combine related fields into a single field before stats and then break them apart again afterwards.

| eval tuple = mvzip(keyword, doc_no)
| stats values(tuple) as tuple by token_id
| eval pairs = split(tuple, ",")
| eval keyword = mvindex(pairs,0), doc_no = mvindex(pairs, 1)
| fields - tuple, pairs

[RSS_STT]

split function proving error.

[richgalloway]

---

@RSS_STT wrote:

split function proving error.

---

I'm not sure what to make of that, but take it you get an (undescribed) error with the code I provided.  I found a missing argument so please try the revised SPL.