About output results of statistical information

When analyzing statistics with Spluk, the order of columns in the output results depends on the command.

Use the table command to sort by any column

About the table command

The table command sorts the columns according to the field name given as an argument.

Command example:

<any search statement> | table field1, field2, field3
In the above case, the columns will be swapped in the order field1, field2, field3.

For example, if you run a command like:

Command example:

sourcetype=access_combined_wcookie
| stats count sum(bytes) as size by clientip,action

The result of execution is as follows.