Hi all,
My query has,
.... | stats latest(time) as recent_event,latest(key) as recent_key, count by field1,field2
and the output has columns (order) like
field1 field2 recent_event recent_key count
(where count is obtained because of "count by")
Is it possible to change the order of the columns
recent_event count field1 recent_key field2
sorry i am totally new to splunk. the number of seach result differs before and after adding
| table recent_event count field1 recent_key field2
by using "count by " the events are grouped based on field1 & field2 (is my understanding correct) and the count of each group is displayed by default under count column.
Hi @manimuthu,
this isn't possible, probably you're analyzing data from different time frames, if you analyze data e.g. of yesterday or one hour ago (in other words: until now), you'll have the same results, because the row I hinted to add doesn't change the results.
Anyway, yes, the stats command groups data by the two fields and gives the result in the count column.
For your knowledge, I hint to follow the Splunk Search Tutorial, to better understand how Splunk works https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial/WelcometotheSearchTutorial
Ciao.
Giuseppe
Hi @manimuthu,
at the end of your search you have to add a table command, something like this:
Your_search
| stats latest(time) as recent_event,latest(key) as recent_key, count by field1 field2
| table recent_event count field1 recent_key field2
Ciao.
Giuseppe
Thanks for replying but its not working for me
Hi @manimuthu,
Why it isn't working for you, what's the limitation?
The only other option is to insert a row like this in the panel visualizing the search results:
<fields>recent_event,count,field1,recent_key,field2</fields>
Ciao.
Giuseppe