how to position a column as the left most column in the statistics view

[HattrickNZ]

I have the following search And I add this column row to show the row numbers but it positions in as the right most column.

...| streamstats count as row

I don't want this I want to position it as the leftmost column. How can I do this? I am pretty sure i have seen this before somewhere.

[ramdaspr · Accepted solution]

Use the table command at the end and specify row as the first field to force the layout you need.

..| streamstats count as row | table row,field1,field2,field3

[HattrickNZ]

tks that will do. I am still thinking there is another way but just not sure what it is.

[ramdaspr]

If you are trying to show it on a dashboard table, you can use the rowNumbers option to display the row numbers which should by default show them leftmost.

AFAIK there arent any other options of explicitly ordering columns, so if you do find any other solutions so post them here..

[rsennett_splunk]

add a by clause, although unless there is more to this... you mean stats not streamstats. As you have it you'll only produce events not statistics in columns.

so, stats count as row by something

something will be on the left, and row on the right.

[HattrickNZ]

tks will try that but it was not exactly what I was looking for. I thought there was a nother way?