sort table values by table values

[sarit_s]

Hello

I have a table with 3 columns

1 is strings

and 2 columns with numbers

is there a way to sort the table from the highest number to lowest from all the values in the table ?

for example:

this is part of my table and i want to sort the numbers in "priority" and "silverpop" regardless if its one of them, just to see the raw with the highest value first

[PickleRick · Accepted solution]

If I understand you correctly, you have more than one collumn and you want to sort by higher of values of those columns, right? So if you have, for example

a	1	1
b	12	2
c	4	6
d	6	8
e	7	25
f	37	4
g	5	11
h	2	3

You would like to have, as an output

f	37	4
e	7	25
b	12	2
g	5	11
d	6	8
c	4	6
h	2	3
a	1	1

If so, then it's probably easiest to add a syntetic column which will be used for sorting and remove it after sorting

< your search > | eval sortcol=max(col1,col2) | sort sortcol | fields - sortcol

[sarit_s]

Hey,

thanks

but it is sorting only the first column

this is my query:

sourcetype="kube:container:notificationsservice-workerservice" Message="Filtered channel context" ("ContextData.ChannelName"=SalesforceEmail OR "ContextData.ChannelName"=SalesforcePriorityEmail)
| stats count AS Priority BY "AdditionalData.Meta.NotificationType"
| rename "AdditionalData.Meta.NotificationType" As Column
| append [ search 
     sourcetype="Silverpop-Transactional-*" Message="Message was successfully sent to *"
     | stats count AS Silverpop BY "AdditionalData.additionalData.AdditionalParameters.MailingID"
     | rename "AdditionalData.additionalData.AdditionalParameters.MailingID" AS Column
     ] | eval sortcol=max(Priority,SilverPop) | sort - sortcol | fields - sortcol

[PickleRick]

Well, |sort sorts all rows by the specified columns so I don't understand what do you mean by "sorts only first column".

[sarit_s]

the result of this query sorts only the Priority column, it is ignoring the Silverpop one

[sarit_s]

sorry, its my bad, i had a typo

thanks, its working

[PickleRick]

No. It seems you have empty results in those columns. That way max(a,b) doesn't make sense if both values are not numbers. So it will not calculate an output value.

You might want to fillnull with a low value before doing the eval=max[...].