Dashboards & Visualizations

How do you sort by a specific order by the values of a field?

johnward4
Communicator

I am trying to figure out if there's a way to sort my table by the Fields "Whs" which have values of :
GUE -- I want to show rows for GUE data first
GUR -- followed by GUR

I also need to sort by a field called "Type" and the sort needs to follow this order of type
Full_CS
Ovsz
PTL
B_Bay
Floor

then repeat in that order showing rows for GUR.

Here's my current query

index=test sourcetype="example" 
| stats values(Machine) as Machine, values(Whs) as Whs, values(Dscrptn) as Dscrptn, values(Percent_Sorted) as Percent_Sorted, sum(Total_CS) as Total_CS, sum(Online_CS) as Online_CS, sum(Inducted_CS) as Inducted_CS, sum(FullCSUnits) as FullCSUnits, sum(Full_CS) as Full_CS, sum(BTS) as BTS, sum(Total_Packed) as Total_Packed, sum(Total_VAS) as Total_VAS, sum(In_VAS) as In_VAS, sum(Total_Non_Vas) as Total_Non_Vas, sum(eval(Total_Units_Machine - (Total_Units_Machine * Percent_Sorted / 100))) as RmnngUnits by Wave, _time
| table Machine, Whs, Wave, Dscrptn, Percent_Sorted, RmnngUnits, Total_CS, Online_CS, Inducted_CS, FullCSUnits, Full_CS, BTS, Total_VAS, Total_Non_Vas, In_VAS, Total_Packed
| sort WHS, Type
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi johnward4,
if you want to sort in alphabetical order, your search is aleady Ok,
if instead you want to sort in a different order, you have to use an hide field, in other words:

 index=test sourcetype="example" 
 | stats values(Machine) as Machine, values(Whs) as Whs, values(Dscrptn) as Dscrptn, values(Percent_Sorted) as Percent_Sorted, sum(Total_CS) as Total_CS, sum(Online_CS) as Online_CS, sum(Inducted_CS) as Inducted_CS, sum(FullCSUnits) as FullCSUnits, sum(Full_CS) as Full_CS, sum(BTS) as BTS, sum(Total_Packed) as Total_Packed, sum(Total_VAS) as Total_VAS, sum(In_VAS) as In_VAS, sum(Total_Non_Vas) as Total_Non_Vas, sum(eval(Total_Units_Machine - (Total_Units_Machine * Percent_Sorted / 100))) as RmnngUnits by Wave, _time
 | table Machine, Whs, Wave, Dscrptn, Percent_Sorted, RmnngUnits, Total_CS, Online_CS, Inducted_CS, FullCSUnits, Full_CS, BTS, Total_VAS, Total_Non_Vas, In_VAS, Total_Packed
| eval rank=case(Type="Full_CS","1",Type="Ovsz","2",Type="PTL","3",Type="B_Bay","4",Type="Floor",5")
| sort WHS, Rank
| fields - Rank

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi johnward4,
if you want to sort in alphabetical order, your search is aleady Ok,
if instead you want to sort in a different order, you have to use an hide field, in other words:

 index=test sourcetype="example" 
 | stats values(Machine) as Machine, values(Whs) as Whs, values(Dscrptn) as Dscrptn, values(Percent_Sorted) as Percent_Sorted, sum(Total_CS) as Total_CS, sum(Online_CS) as Online_CS, sum(Inducted_CS) as Inducted_CS, sum(FullCSUnits) as FullCSUnits, sum(Full_CS) as Full_CS, sum(BTS) as BTS, sum(Total_Packed) as Total_Packed, sum(Total_VAS) as Total_VAS, sum(In_VAS) as In_VAS, sum(Total_Non_Vas) as Total_Non_Vas, sum(eval(Total_Units_Machine - (Total_Units_Machine * Percent_Sorted / 100))) as RmnngUnits by Wave, _time
 | table Machine, Whs, Wave, Dscrptn, Percent_Sorted, RmnngUnits, Total_CS, Online_CS, Inducted_CS, FullCSUnits, Full_CS, BTS, Total_VAS, Total_Non_Vas, In_VAS, Total_Packed
| eval rank=case(Type="Full_CS","1",Type="Ovsz","2",Type="PTL","3",Type="B_Bay","4",Type="Floor",5")
| sort WHS, Rank
| fields - Rank

Bye.
Giuseppe

0 Karma

johnward4
Communicator

Thank you @cusello ! this is exactly what I needed

0 Karma

Keysofsandiego
Path Finder

The Last 2 fields should be lowercase rank's (not camelcase Rank). as the eval is creating a new field called "rank"

 | sort WHS, rank
 | fields - rank

That being said DUDE ThAnKs! YoU ToTaLlY gOt Me WhAt I nEeDeD! 
=)

UPVOTE HIS ANSWER PLZ!

0 Karma

johnward4
Communicator

alt text

Here's an example from a dashboard I'm trying to replicate in Splunk.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...