Splunk Search

How can I have a pivot table sorted by the sum of column values automatically instead of manually sorting each time?

clifforg
Explorer

I have created a pivot table in the Pivot Builder and it shows the information that I need. However, I want the pivot table sorted by the SUM of the column values (which is the data I am showing) rather than the "split rows" field. I can sort the pivot table manually each time by clicking the column header - but how do I save this into the pivot table?

I cannot simple sort the source data as the pivot table is doing the sum on the source data for me.

tdhellma
New Member

You should be able to sort the sum done in your pivot as long as you put a pipe between them so that the sum command can return results before you try to sort on its results.

Here's an example from something I'm working on that sounds similar to what you're trying to do - sort results descending on a sum column:

| pivot Sale Sale sum(Cost) AS "Sum of Cost" SPLITROW Publisher | sort -"Sum of Cost"

Through the Pivot builder GUI you can also select the sort dropdown under the x-axis header to sort some types of visualizations.

Let me know if this didn't answer your question.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...