order changing with the table command ??

[rakesh_498115]

Hi.

When i am using the table command ? i am not getting the fields in the order i have ginen ??
how can i do it be in the same order which i have mentioned ??

my query is :

soucetype="mydata" | table _raw,Recieved,Sent

i want this order of display . but i am gettin in Received,Sent,_raw in this order ..pls help..i want the same order mentiond with the table commmand ..

[arihant16cse]

| table Receive,sent,_raw

[rajeev_ku]

Best way to do it as below
soucetype="mydata" | rename _raw as newraw | table Recieved, Sent, newraw
it will adjust raw data at most right position.

[MuS · Accepted solution]

Hi

it took me some reading the docs and trying out of some commands and I got what you are looking for 😉

the easiest way is to rename _raw to anything and use the new field name in the table:

 soucetype="mydata" | rename _raw as newraw | table newraw, Recieved, Sent

there are probably more effective ways of doing this, but it worked for example you provided and it answers your question.

cheers,

MuS

[rakesh_498115]

Thans Mus .. i got it now ..:)

[MuS]

rakesh, sorry but I hope you are aware that you can scroll a windows not only up and down but also to the left or to the right? _raw is usually very long, therefore received and sent are WAY ON THE RIGHT of your screen.

[rakesh_498115]

Hi MuS,

when i am used like this..i am getting the newraw values alone...Received , Sent are not at all displayin ..pls help..

[Ayn]

Use fields.

fields _raw,Received,Sent

[rakesh_498115]

fields command is not working like this .... 😞