Splunk Search

Refer to a field in table by its position

nabeel652
Builder

Wondering if we can do something like this:

... | table * | sort by <1>

Where <1> refers to the first field in the table as the field names are dynamic and subject to change.

Tags (2)
0 Karma
1 Solution

HiroshiSatoh
Champion

If the order of field names is acceptable

 ... | table * |sort [search (your search)|head 1 | table * | stats dc(*) as * | transpose |head 1|rename column as query]

View solution in original post

0 Karma

HiroshiSatoh
Champion

If the order of field names is acceptable

 ... | table * |sort [search (your search)|head 1 | table * | stats dc(*) as * | transpose |head 1|rename column as query]
0 Karma

nabeel652
Builder

Awesome, that worked. Can you please explain this?

| rename column as query
0 Karma

HiroshiSatoh
Champion

The return value will be the value only. Usually field = value.

special field:query

index=* [inputlookup xxx.csv | fields col_a]
->(col_a=1) OR (col_a=2) OR (col_a=3) ・・・・

index=* [inputlookup xxx.csv | rename col_a as query | fields query]
->(1) OR (2) OR (3) ・・・・

0 Karma

jkat54
SplunkTrust
SplunkTrust

Try this

 | stats values(*) as * | sort 0 *
0 Karma

nabeel652
Builder

Nope, this will group everything up in one cell which is not the desired outcome 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...