About output results of statistical information

When analyzing statistics with Spluk, the order of columns in the output results depends on the command.

Use the table command to sort by any column

About the table command

The table command sorts the columns according to the field name given as an argument.

Command example:

In the above case, replace the columns in order of field1, field2, field3.

For example, if you run a command like:

Command example:

sourcetype=access_combined_wcookie
| stats count sum(bytes) as size by clientip,action

The result of execution is as follows.

Suppose that the table command is used as follows for the above result.

Command example

sourcetype=access_combined_wcookie
| stats count sum(bytes) as size by clientip,action
| table clientip,size,action,count

The result of execution is as follows.