Splunk Search

how to position a column as the left most column in the statistics view

HattrickNZ
Motivator

I have the following search And I add this column row to show the row numbers but it positions in as the right most column.

...| streamstats count as row

I don't want this I want to position it as the leftmost column. How can I do this? I am pretty sure i have seen this before somewhere.

Tags (3)
0 Karma
1 Solution

ramdaspr
Contributor

Use the table command at the end and specify row as the first field to force the layout you need.

..| streamstats count as row | table row,field1,field2,field3

View solution in original post

ramdaspr
Contributor

Use the table command at the end and specify row as the first field to force the layout you need.

..| streamstats count as row | table row,field1,field2,field3

HattrickNZ
Motivator

tks that will do. I am still thinking there is another way but just not sure what it is.

0 Karma

ramdaspr
Contributor

If you are trying to show it on a dashboard table, you can use the rowNumbers option to display the row numbers which should by default show them leftmost.

AFAIK there arent any other options of explicitly ordering columns, so if you do find any other solutions so post them here..

0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

add a by clause, although unless there is more to this... you mean stats not streamstats. As you have it you'll only produce events not statistics in columns.

so, stats count as row by something

something will be on the left, and row on the right.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma

HattrickNZ
Motivator

tks will try that but it was not exactly what I was looking for. I thought there was a nother way?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...