Splunk Search

preserve original table column order after untable and xyseries commands

iKate
Builder

Hi-hi!
Is it possible to preserve original table column order after untable and xyseries commands?
E.g.:
...
| table period orange lemon ananas apple cherry (and I need right this sorting afterwards but transposed with header in "period")
| untable period name value
| xyseries name period value

and instead initial table column order I get lexicographical sorting:

name     period1      period2     period3     period4     period5
ananas
apple
cherry
lemon
orange

At the moment I see just variant with renaming columns to contain digit in the beginning but it's not convenient as I have several dozens of them %)

jeffland
SplunkTrust
SplunkTrust

In my experience, most search commands resort the columns in lexicographic order and there's nothing you can do about it. To sort rows, you'll have to use sort afterwards and to sort columns you'll need to use either fields or table.

0 Karma

iKate
Builder

Thanks for your answer jeffland. Seems there's nothing to do with this.

0 Karma
Get Updates on the Splunk Community!

Announcing the Expansion of the Splunk Academic Alliance Program

The Splunk Community is more than just an online forum — it’s a network of passionate users, administrators, ...

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...