Splunk Search

preserve original table column order after untable and xyseries commands

iKate
Builder

Hi-hi!
Is it possible to preserve original table column order after untable and xyseries commands?
E.g.:
...
| table period orange lemon ananas apple cherry (and I need right this sorting afterwards but transposed with header in "period")
| untable period name value
| xyseries name period value

and instead initial table column order I get lexicographical sorting:

name     period1      period2     period3     period4     period5
ananas
apple
cherry
lemon
orange

At the moment I see just variant with renaming columns to contain digit in the beginning but it's not convenient as I have several dozens of them %)

jeffland
SplunkTrust
SplunkTrust

In my experience, most search commands resort the columns in lexicographic order and there's nothing you can do about it. To sort rows, you'll have to use sort afterwards and to sort columns you'll need to use either fields or table.

0 Karma

iKate
Builder

Thanks for your answer jeffland. Seems there's nothing to do with this.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...