I created a dashboard with the following query that displays everything I need however the addtotals field "Total" is the last column in the table. How can I move it to the 2nd column? Thanks
Search | rex field=_raw ".renderTime.*connect.*send.*ms.(?.\w+)." | fields + host + AccountID | stats count by host, AccountID | xyseries AccountID host count | addtotals host*
Current Output:
AcccountID Host1 Host2 Host3 Total
Desired Output:
AccountID Total Host1 Host2 Host3
Try like this
Search | rex field=_raw ".*renderTime.*connect.send.ms.(?.\w+)." | fields + host + AccountID | stats count by host, AccountID | xyseries AccountID host count | addtotals | table AccountID Total *
You can rearrange field display order by using the fields
command:
your search | fields AccountID Total Host1 Host2 Host3