Splunk Search

sort column based on dynamic parameters

krishman23
Explorer

My table has variable columns size as
Id, description, detail1, detail2, detail3, detail4, price1, price2, price3, price4,

here detail has price related to the number at the end
some row may have 1 details and some may have 2 or more, but will be in detail - price pair

I want my table in format
id, description, detail1, price1, detail2, price2 ...

Tags (1)
0 Karma

somesoni2
Revered Legend

Are the number suffix on details* and price* columns fixed?

0 Karma

niketn
Legend

@krishman23, please add the following three pipes to your existing search and see:

 <yourCurrentSearchWithOutputTable>
|  rename "detail*" as "*detail", "price*" as "*price"
|  table Id description 1* 2* 3* 4*
|  rename "*detail" as "detail*", "*price" as "price*"

Following is a run anywhere example:

|  makeresults
|  eval _raw="Id=2327163, description=\"some desc\", detail1=\"detail 1\", detail2=\"deatil 2\", detail3=\"detail 3\", detail4=\"detail 4\", price1=\"price 1\", price2=\"price 2\", price3=\"price 3\", price4=\"price 4\""
|  KV
|  fields - _*
|  rename "detail*" as "*detail", "price*" as "*price"
|  table Id description 1* 2* 3* 4*
|  rename "*detail" as "detail*", "*price" as "price*"

PS: If you are using some transforming command/s to arrive to the sequence of fields as in your question, do share your query for us to see if this sequence of columns can be handled before showing the above results.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

krishman23
Explorer

Two things that are weird,
1. In " | table Id description 1* 2* 3* 4* " : I want numbers to be added dynamically
2. In "| rename "detail" as "detail", "price" as "price" " : ruins the table format an get back to same old format.

0 Karma

niketn
Legend

Can you just use the following table pipe in second last command and remove the final rename?

|  table Id description *

Also while posting code use the code button (i.e. 101010) or shortcut key Ctrl+K to ensure that special character does not escape.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...