Splunk Search

Ordering Columns Not Working

matthewcanty
Communicator

http://splunk-base.splunk.com/answers/49712/can-we-sort-command-for-sorting-the-table-records-rowwis...

Hi All,

I have a column chart and want to order the columns. The above link isn't quite what I am looking for. My search query is as follows, and works all apart from I'd like it ordering.

host="*90*" FeedSource | search Fixture>0 | stats max(_time) As LatestTime By Action | eval Gap=time()-LatestTime | chart last(Gap) by Action`

How can I order the fields such as CACHE_INSERT CACHE_UPDATE etc?

Many thanks in advance.

0 Karma
1 Solution

lguinn2
Legend

I am not sure this will work, but try putting the table command at the end of your search, listing the fields in the order that you want them to appear. Be sure to list them all!

host="*90*" FeedSource Fixture>0 
| stats max(_time) As LatestTime By Action 
| eval Gap=time()-LatestTime 
| chart last(Gap) as lastGap by Action
| table CACHE_INSERT CACHE_UPDATE

I do see some problems with this. First time() is the current wall clock time - even if you want the "current" time, I would use now(). now() is when the search began, and so it will be consistent for all events in this search. But time() will vary based on how long this search takes to run.

The second problem is that your table command must list all the values of Action. If these change, then your search must be updated.

View solution in original post

0 Karma

lguinn2
Legend

I am not sure this will work, but try putting the table command at the end of your search, listing the fields in the order that you want them to appear. Be sure to list them all!

host="*90*" FeedSource Fixture>0 
| stats max(_time) As LatestTime By Action 
| eval Gap=time()-LatestTime 
| chart last(Gap) as lastGap by Action
| table CACHE_INSERT CACHE_UPDATE

I do see some problems with this. First time() is the current wall clock time - even if you want the "current" time, I would use now(). now() is when the search began, and so it will be consistent for all events in this search. But time() will vary based on how long this search takes to run.

The second problem is that your table command must list all the values of Action. If these change, then your search must be updated.

0 Karma

lguinn2
Legend

Would it make sense to use the stats command instead of the chart command?

0 Karma

lguinn2
Legend

Sorry - didn't know this was a RT search - then time() IS a better choice.

0 Karma

matthewcanty
Communicator

Thanks, seems to have had the same effect as in the link I posted in my question. Also using now() in a real-time search causes the results to gradually move into greater negative values.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...