This page explains how to use the project-reorder operator in APL.
project-reorder
operator in APL allows you to rearrange the fields of a dataset without modifying the underlying data. This operator is useful when you need to control the display order of fields in query results, making your data easier to read and analyze. It can be especially helpful when working with large datasets where field ordering impacts the clarity of the output.
Use project-reorder
when you want to emphasize specific fields by adjusting their order in the result set without changing their values or structure.
Splunk SPL users
table
command to reorder fields, which works similarly to how project-reorder
functions in APL.ANSI SQL users
SELECT
statement determines their arrangement in the output. In APL, project-reorder
provides more explicit control over the field order without requiring a full SELECT
clause.Field1, Field2, ...
: The names of the fields in the order you want them to appear in the result set.[asc | desc | granny-asc | granny-desc]
: Optional: Specifies the sort order for the reordered fields. asc
or desc
order fields by field name in ascending or descending manner. granny-asc
or granny-desc
order by ascending or descending while secondarily sorting by the next numeric value. For example, b50
comes before b9
when you use granny-asc
.project-reorder
doesn‘t rename or remove fields from the dataset. All fields that existed in the dataset appear in the results table.
_time | method | status | uri | req_duration_ms | geo.city | geo.country |
---|---|---|---|---|---|---|
2024-10-17 12:34:56 | GET | 200 | /home | 120 | New York | USA |
2024-10-17 12:35:01 | POST | 404 | /api/v1/resource | 250 | Berlin | Germany |
_time
, method
, status
) at the front for easier analysis.data*
or ['data.fo']*
.
Here’s how you can use wildcards in project-reorder
:
Reorder all fields in ascending order:
project
operator to select and rename fields without changing their order.extend
adds new calculated fields while keeping the original ones in place.summarize
to perform aggregations on fields, which can then be reordered using project-reorder
.project-reorder
.