Is there a way to get my saved search to sort the resulting table properly when run on my dashboard?

[dolfantimmy]

I am using a search cloned from the SoS app. I modified it to sort in the search itself. Though the search does run on my dashboard, it doesn't sort the table using the sort I have at the end of the saved search. Is there a way to specify the sort field in the simple XML?

[vasanthmss]

Hi dolfantimmy,

Please ensure your search doesn't contains any macro's / eventtypes which is created by the SoS.

Most of the SoS application search string contains macro's those are with permission "in app" so probably you need to change the permission to global.

I tried locally its working fine. could you please share the exact query what you are cloned from SoS.

Cheers!
VaSu

[dolfantimmy]

Slightly modified from sos, here's the search. It run great in the search app. And does display data on my dashboard, but the data is not sorted when shown on the dashboard.


(host="sp3ctxqs01" OR splunk_server=local) action=search (id=* OR search_id=)
| eval search_id=if(isnull(search_id), id, search_id)
| replace '' with * in search_id
| search search_id!=rt_* search_id!=searchparsetmp*
| rex "search='(?

.?)', autojoin"
| rex "savedsearch_name=\"(?.?)\"]["
| eval search=case(isnotnull(search),search,isnull(search) AND savedsearch_name!="","Scheduled search name : ".savedsearch_name,isnull(search) AND savedsearch_name=="","SID : ".search_id)
| convert num(total_run_time)
| eval user = if(user="n/a", "nobody", user)
| stats min(_time) as _time last(user) as user max(total_run_time) as total_run_time last(search) as search by search_id | search search_id=* search!=typeahead* search!="|history*" search!=_internal search!=_audit|sort -total_run_time


[gfuente]

Is there a missing space between the minus sign and the field name?? Shouldn´t it be:

... |sort - total_run_time 

[dolfantimmy]

Thanks gfuente, I tried that with the same results. The dashboard still displays sorted by event time, not by total_run_time.

[dolfantimmy]

I meant to say I'm using a search cloned FROM the SoS app.

[ppablo]

Just edited it for ya @dolfantimmy You might want to include the search you're using and how you want the resulting table to display for search gurus to better assist you.