Splunk Search

Create field which its values are in reverse order

cycheng
Path Finder

I have a search command and it return below results:
[mysearch]|dedup version|fields version

version
11
22
33
44

I would like to create another field which its values are in reverse order of version as below, how can I do in search command?

version   reverse_version
11        44
22        33
33        22
44        11
Tags (3)
1 Solution

kristian_kolb
Ultra Champion

Have you looked at the sort search command? Not good enough?

If you really want to have original order and reverse order in separate columns in the same table, then you'll have to look at appendcols;

<your base search> | appendcols [search <your base search>| rename version as rev_version| sort -rev_version]

a faster way would be appendpipe, but your table would be skewed;

<your base search> | appendpipe [rename version as rev_version| sort -rev_version]

Hope this helps..

Kristian

View solution in original post

kristian_kolb
Ultra Champion

Have you looked at the sort search command? Not good enough?

If you really want to have original order and reverse order in separate columns in the same table, then you'll have to look at appendcols;

<your base search> | appendcols [search <your base search>| rename version as rev_version| sort -rev_version]

a faster way would be appendpipe, but your table would be skewed;

<your base search> | appendpipe [rename version as rev_version| sort -rev_version]

Hope this helps..

Kristian

kristian_kolb
Ultra Champion

yeah, well, that stats command is part of what I meant with <your base search>.

However, you'll be running the same search twice, both in the outer and inner search (i.e. the subsearch).

The second option, appendpipe, operates on the results from first search, which - at least in this case - is a very small set of data (4 events).

0 Karma

cycheng
Path Finder

Thanks Kristian, the first search command is working!
And I have to add the stats command as below:

| dedup version | stats count by version | appendcols [search | dedup version | rename version as rev_version | sort -rev_version] | fields version rev_version

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...