Splunk Search

preserve original table column order after untable and xyseries commands

iKate
Builder

Hi-hi!
Is it possible to preserve original table column order after untable and xyseries commands?
E.g.:
...
| table period orange lemon ananas apple cherry (and I need right this sorting afterwards but transposed with header in "period")
| untable period name value
| xyseries name period value

and instead initial table column order I get lexicographical sorting:

name     period1      period2     period3     period4     period5
ananas
apple
cherry
lemon
orange

At the moment I see just variant with renaming columns to contain digit in the beginning but it's not convenient as I have several dozens of them %)

jeffland
Champion

In my experience, most search commands resort the columns in lexicographic order and there's nothing you can do about it. To sort rows, you'll have to use sort afterwards and to sort columns you'll need to use either fields or table.

0 Karma

iKate
Builder

Thanks for your answer jeffland. Seems there's nothing to do with this.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...