Splunk Search

Ordering an alpha numerical column and highlighting

shakSplunk
Path Finder

Hi all,

I have the following dataset:

Name TitleDaysRemaining
TomWest50
Martinerrorerror
Billy Winter5103
WillFable2

 

I was wondering if there is a way to order the DaysRemaining field by first showing the 'error' value on the top and then ordering in ascending order - i.e. 2,50 and 5103?

In addition, is there a way to only highlight the DaysRemaining field, in which 'error' is highlighted red, values between 0-30 are also red, values between 30 - 100 are orange and values above 100 are green?

Desired outcome:

e.g..PNG

 

Appreciate any and all help greatly!

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

By default, sort will put alpha after numbers, so you will have to create a new field to sort on, which is dependent on the value of DaysRemaining. Use this code

| eval sort=if(DaysRemaining>0, DaysRemaining, -999)
| sort sort DaysRemaining
| fields - sort

 the sort field will be -999 if the DaysRemaining is alpha, so the sort will then sort on that field, which you can then remove.

As for colours, you can set colours for the numeric values, but to get the text field coloured also, I suspect you'll have to use CSS

 

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...