Can columns created by a transpose be ordered?

Comments

5 comments

  • Official comment
    Avatar
    Nick

    Hello,

    In your case, since you know the column names ahead of time, you could manually order them by doing something like this:

    _source=Alarms
    | timeslice 1d
    | count by _timeslice, severity
    | fillmissing timeslice(1d), values("0", "1", "2", "3", "4", "5", "6", "7") in severity 
    | transpose row _timeslice column severity as (%"0", %"1", %"2", %"3", %"4", %"5", %"6", %"7")
    | fields _timeslice,%"0", %"1", %"2", %"3", %"4", %"5", %"6", %"7"

    Let me know if that helps.

    Additionally, there is a feature request out there to implement dynamic sorting on the transpose operator output, and I recommend voting on it if you think it would be useful: https://ideas.sumologic.com/ideas/SL-I-1293

    Thanks,
    Nick Wilson

    Comment actions Permalink
  • Avatar
    Product Team

    That worked. Thanks!

    Charles

    0
    Comment actions Permalink
  • Avatar
    Nick

    You're welcome, Charles!

    0
    Comment actions Permalink
  • Avatar
    Steven Bogar

    what if the columns are not known ahead of time?  I am trying to do a similar query but running into the same issue, the problem is, I have a variable number of strings that are returned.

    _source="RDS Events" and _collector="aws_config" and "Finished DB Instance Backup"
    | parse "\\\"Source ID\\\":\\\"*\\\"" as DBInstanceIdentifier
    | timeslice 24h
    | count by _timeslice, DBInstanceIdentifier
    | transpose row _timeslice column dbinstanceidentifier
    | order by _timeslice desc

    0
    Comment actions Permalink
  • Avatar
    Nick

    Hi Steven,

    This is currently on our feature request portal. I highly recommend that you vote and comment on it to let our product team know that it's important to you. https://ideas.sumologic.com/ideas/SL-I-1293

    Thanks,
    Nick

    0
    Comment actions Permalink

Please sign in to leave a comment.