Splunk Search

single value visualization sorting issue

Puvi
New Member

Hi,

i have a query which sorts the results, but when i change it to single value its not getting sorted
can anyone help in this?

Tags (3)
0 Karma

woodcock
Esteemed Legend

The trellis (and other) features will resort your stuff alphabetically so if you need to keep certain things in front, you need to add a series of leading spaces to the value, which will cause them to remain sorted your way but still appear the same when used as a field name, something like this:

| makeresults count=5
| streamstats count
| eval sortmebad=case(count==1, "one", count==2, "two", count==3, "three", count==4, "four", true(), "five")
| eval sortmegood=case(count==1, "    one", count==2, "   two", count==3, "  three", count==4, " four", true(), "five")
| multireport
[ | sort 0 sortmebad | eval sortmegood=null() ]
[ | sort 0 sortmegood | eval sortmebad=null() ]

niketn
Legend

@Puvi is it Single Value with Trellis Layout?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Puvi
New Member

yes it is using trells layout

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What is the query?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...