Splunk Search

Eval fields are returned in strange order when using transaction and join commands

fere
Path Finder

I have defined thw following search, but it returns the fields in the wrong order:

source="xxxx" | eventTransIncludeOrphans("step1Invite","step1end" ) | stats count as all_req_invite_count, count(eval(_txn_orphan=1)) as req_invite_orphan_count | eval dropPct = req_invite_orphan_count/ all_req_invite_count * 100 | join nextStep [search source="xxxx" |eventTransIncludeOrphans("step2Invite","step2end" ) | stats count as all_req_invite_count2, count(eval(_txn_orphan=1)) as req_invite_orphan_count2 | eval dropPct2 = req_invite_orphan_count2/ all_req_invite_count2 * 100 ]

the fields show up in the following order - dropPct adn dropPct2 are in wrong places:

all_req_invite_count    req_invite_orphan_count all_req_invite_count2   dropPct dropPct2    req_invite_orphan_count2

If I don't include the 2 pct fields, the 4 fields returned show up in the order that were defined.
How can I make them all show up in the order that were defined in the search string?
Thanks

Tags (3)
0 Karma
1 Solution

cphair
Builder

You can reorder the fields by piping your whole search to the fields command, specifying the order you want them to take.


... | fields all_req_invite_count, req_invite_orphan_count, dropPct, all_req_invite_count2, req_invite_orphan_count2, dropPct2
</code.

View solution in original post

0 Karma

cphair
Builder

You can reorder the fields by piping your whole search to the fields command, specifying the order you want them to take.


... | fields all_req_invite_count, req_invite_orphan_count, dropPct, all_req_invite_count2, req_invite_orphan_count2, dropPct2
</code.

0 Karma

fere
Path Finder

thx, worked.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...