I want to sort based on the 2nd column generated dynamically post using xyseries command
index="aof_mywizard_deploy_idx" sourcetype="aof_tm_source" | rename "Timelines_FY17 FY18_Q1" as "Completetion_date" |eval c_status=upper('Current Week Status') |search c_status!="TBC"| stats count(c_status) as count by Completetion_date c_status |eventstats sum(count) as Total by Completetion_date| eval ragcount% = (round((count/Total)100))."%"| xyseries c_status Completetion_date count ragcount%|rename "count: *" as ":Count" "ragcount%: " as ":Percent%" |table c_status *|rename c_status as "RAG STATUS"
Columns generated are Rag status, FY17:Count FY17:percent% Fy18-Q1:count.. etc. I want to sort with the first count (in this case FY17:Count) . How can i do that? can some one please help? if i give sort - "FY17:Count" it works.. but since its dynamically generated , is there a way to handle this?
Hi - You can use the value of another field as the name of the destination field by using curly brackets, { }. For example, if you have an event with the following fields, aName=counter and aValue=1234. Use | eval {aName}=aValue to return counter=1234.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Eval
Add a dynamic eval |eval {xxxx}=value, then | sort -eval {xxxx}