Splunk Search

preserve original table column order after untable and xyseries commands

iKate
Builder

Hi-hi!
Is it possible to preserve original table column order after untable and xyseries commands?
E.g.:
...
| table period orange lemon ananas apple cherry (and I need right this sorting afterwards but transposed with header in "period")
| untable period name value
| xyseries name period value

and instead initial table column order I get lexicographical sorting:

name     period1      period2     period3     period4     period5
ananas
apple
cherry
lemon
orange

At the moment I see just variant with renaming columns to contain digit in the beginning but it's not convenient as I have several dozens of them %)

jeffland
SplunkTrust
SplunkTrust

In my experience, most search commands resort the columns in lexicographic order and there's nothing you can do about it. To sort rows, you'll have to use sort afterwards and to sort columns you'll need to use either fields or table.

0 Karma

iKate
Builder

Thanks for your answer jeffland. Seems there's nothing to do with this.

0 Karma
Get Updates on the Splunk Community!

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...