Splunk Search

Eval fields are returned in strange order when using transaction and join commands

fere
Path Finder

I have defined thw following search, but it returns the fields in the wrong order:

source="xxxx" | eventTransIncludeOrphans("step1Invite","step1end" ) | stats count as all_req_invite_count, count(eval(_txn_orphan=1)) as req_invite_orphan_count | eval dropPct = req_invite_orphan_count/ all_req_invite_count * 100 | join nextStep [search source="xxxx" |eventTransIncludeOrphans("step2Invite","step2end" ) | stats count as all_req_invite_count2, count(eval(_txn_orphan=1)) as req_invite_orphan_count2 | eval dropPct2 = req_invite_orphan_count2/ all_req_invite_count2 * 100 ]

the fields show up in the following order - dropPct adn dropPct2 are in wrong places:

all_req_invite_count    req_invite_orphan_count all_req_invite_count2   dropPct dropPct2    req_invite_orphan_count2

If I don't include the 2 pct fields, the 4 fields returned show up in the order that were defined.
How can I make them all show up in the order that were defined in the search string?
Thanks

Tags (3)
0 Karma
1 Solution

cphair
Builder

You can reorder the fields by piping your whole search to the fields command, specifying the order you want them to take.


... | fields all_req_invite_count, req_invite_orphan_count, dropPct, all_req_invite_count2, req_invite_orphan_count2, dropPct2
</code.

View solution in original post

0 Karma

cphair
Builder

You can reorder the fields by piping your whole search to the fields command, specifying the order you want them to take.


... | fields all_req_invite_count, req_invite_orphan_count, dropPct, all_req_invite_count2, req_invite_orphan_count2, dropPct2
</code.

0 Karma

fere
Path Finder

thx, worked.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...