Splunk Search

Sort based on first count generated by xyseries dynamically

k_harini
Communicator

I want to sort based on the 2nd column generated dynamically post using xyseries command
index="aof_mywizard_deploy_idx" sourcetype="aof_tm_source" | rename "Timelines_FY17 FY18_Q1" as "Completetion_date" |eval c_status=upper('Current Week Status') |search c_status!="TBC"| stats count(c_status) as count by Completetion_date c_status |eventstats sum(count) as Total by Completetion_date| eval ragcount% = (round((count/Total)100))."%"| xyseries c_status Completetion_date count ragcount%|rename "count: *" as ":Count" "ragcount%: " as ":Percent%" |table c_status *|rename c_status as "RAG STATUS"

Columns generated are Rag status, FY17:Count FY17:percent% Fy18-Q1:count.. etc. I want to sort with the first count (in this case FY17:Count) . How can i do that? can some one please help? if i give sort - "FY17:Count" it works.. but since its dynamically generated , is there a way to handle this?

0 Karma

Sukisen1981
Champion

Hi - You can use the value of another field as the name of the destination field by using curly brackets, { }. For example, if you have an event with the following fields, aName=counter and aValue=1234. Use | eval {aName}=aValue to return counter=1234.

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Eval

Add a dynamic eval |eval {xxxx}=value, then | sort -eval {xxxx}

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...