Number 2 does not do sorting in the table itself, that is simply used as the base search in the dashboard to drive the sorting of the visualisation panels, which is what I understood you wanted to do...
See more...
Number 2 does not do sorting in the table itself, that is simply used as the base search in the dashboard to drive the sorting of the visualisation panels, which is what I understood you wanted to do. There is no practical column limit to the prefix solution, you just need to make the prefix fit the requirement, i.e. change the | eval name=... to | eval name=printf("_%02d_%s", c, column) and you will have a sortable 01_xxx 02_yyy syntax. As for a subsearch, the problem you face is that generally a subsearch runs BEFORE the primary search, so the subsearch cannot generate the structure for the table command as the timechart has not yet run. The exception to that is the appendpipe subsearch, which runs inline with the primary search, which I gave as an example, however, this subsearch is different in that it is creating new rows so it can't be used to push data into the commands in the existing pipeline. I did figure out how to do the double transpose without knowing the column count | transpose 0
| sort - [
| makeresults earliest=-60m@m latest=@m
| timechart fixedrange=t count
| stats count as row
| eval search="row ".row
| format "" "" "" "" "" ""
]
| transpose 0 header_field=column
| fields - column the earliest/latest may not be needed in the real world, as long as the timechart and time range matches the outer search, it will get the same row count, so the sort will work with correct column name. If you do find another way, please post here - it's an interesting SPL challenge.