i have a table as below.
one two three four total five six
i want the "total" column to be shown at the end always, like below, need help to do this..
one two three four five six total.
also note that the column names are dynamic and can change, but "total" column name remains the same..
Another way to do it:
| makeresults | fields - _time
| eval a=1,b=2,c=3,d=4
| eval Total=a+b+c
| table * Total
Using the table
command, you can force the field order. In this example, it is saying "list all the fields but put Total at the end."
a b c d Total
1 2 3 4 6
did this using below:
|search query
|rename total as T
|eval total=T
|fields - T
this ends up the column total at the end, right most ..
did this using below:
|search query
|rename total as T
|eval total=T
|fields - T
this ends up the column total at the end, right most ..