i have a query which sorts the results, but when i change it to single value its not getting sorted
can anyone help in this?
trellis (and other) features will resort your stuff alphabetically so if you need to keep certain things in front, you need to add a series of leading spaces to the value, which will cause them to remain sorted your way but still appear the same when used as a field name, something like this:
| makeresults count=5 | streamstats count | eval sortmebad=case(count==1, "one", count==2, "two", count==3, "three", count==4, "four", true(), "five") | eval sortmegood=case(count==1, " one", count==2, " two", count==3, " three", count==4, " four", true(), "five") | multireport [ | sort 0 sortmebad | eval sortmegood=null() ] [ | sort 0 sortmegood | eval sortmebad=null() ]
@Puvi is it Single Value with Trellis Layout?
yes it is using trells layout
What is the query?