Splunk Search

preserve original table column order after untable and xyseries commands

iKate
Builder

Hi-hi!
Is it possible to preserve original table column order after untable and xyseries commands?
E.g.:
...
| table period orange lemon ananas apple cherry (and I need right this sorting afterwards but transposed with header in "period")
| untable period name value
| xyseries name period value

and instead initial table column order I get lexicographical sorting:

name     period1      period2     period3     period4     period5
ananas
apple
cherry
lemon
orange

At the moment I see just variant with renaming columns to contain digit in the beginning but it's not convenient as I have several dozens of them %)

jeffland
SplunkTrust
SplunkTrust

In my experience, most search commands resort the columns in lexicographic order and there's nothing you can do about it. To sort rows, you'll have to use sort afterwards and to sort columns you'll need to use either fields or table.

0 Karma

iKate
Builder

Thanks for your answer jeffland. Seems there's nothing to do with this.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...