Splunk Search

how to position a column as the left most column in the statistics view

HattrickNZ
Motivator

I have the following search And I add this column row to show the row numbers but it positions in as the right most column.

...| streamstats count as row

I don't want this I want to position it as the leftmost column. How can I do this? I am pretty sure i have seen this before somewhere.

Tags (3)
0 Karma
1 Solution

ramdaspr
Contributor

Use the table command at the end and specify row as the first field to force the layout you need.

..| streamstats count as row | table row,field1,field2,field3

View solution in original post

ramdaspr
Contributor

Use the table command at the end and specify row as the first field to force the layout you need.

..| streamstats count as row | table row,field1,field2,field3

HattrickNZ
Motivator

tks that will do. I am still thinking there is another way but just not sure what it is.

0 Karma

ramdaspr
Contributor

If you are trying to show it on a dashboard table, you can use the rowNumbers option to display the row numbers which should by default show them leftmost.

AFAIK there arent any other options of explicitly ordering columns, so if you do find any other solutions so post them here..

0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

add a by clause, although unless there is more to this... you mean stats not streamstats. As you have it you'll only produce events not statistics in columns.

so, stats count as row by something

something will be on the left, and row on the right.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma

HattrickNZ
Motivator

tks will try that but it was not exactly what I was looking for. I thought there was a nother way?

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...