topic Re: How to disable automatic sorting in table in Deployment Architecture

How to disable automatic sorting in table

smolcj — Fri, 08 Feb 2013 08:29:33 GMT

Hi,
i have a table displaying log messages alone and their timestamp is same as they have only micro milliseconds difference in their occurrence, in the table the lo details are sorted according to the alphabetic order of the log details, i want it as it is in the log file.. How can i do this?
Please help
Thank you

Re: How to disable automatic sorting in table

lguinn2 — Fri, 08 Feb 2013 08:33:53 GMT

Try

yoursearchhere
| sort _time
| table field1 field2 field3

However, I am not sure that I really undersand the question. It would be better to see your actual search.

Re: How to disable automatic sorting in table

Drainy — Fri, 08 Feb 2013 08:48:57 GMT

Yes, or perhaps to tell us how it appears in the log file so we actually understand how you want it to look 😛 Its pretty hard to replicate it without knowing! Although Lguinn is probably bang on the money with a sort by time

Re: How to disable automatic sorting in table

smolcj — Mon, 28 Sep 2020 13:16:27 GMT

this is my search lguinn

 index=main source=file.txt|transaction startswith=START endswith=END maxevents=10000 |fields log_details |mvexpand log_details |join  log_details [search index=main source=file.txt ]|table _time severity msg_code log_details |fields - _raw |sort _time

Re: How to disable automatic sorting in table

Drainy — Fri, 08 Feb 2013 09:07:10 GMT

and how does it appear in the log file?

Re: How to disable automatic sorting in table

smolcj — Fri, 08 Feb 2013 09:16:32 GMT

nearly 15 logs with same timestamp.. it will be like
2011-12-13 10:12:12 :ERROR: Target connection group #1 consists of target error
2011-12-13 10:12:12 :INFO :Writer initialization complete.
2011-12-13 10:12:12 :ERROR :DTM log error
2011-12-13 10:12:12 :INFO :Writer run started.
and the output table is like
2011-12-13 10:12:12 :ERROR :DTM log error
2011-12-13 10:12:12 :INFO :Writer initialization complete.
2011-12-13 10:12:12 :INFO :Writer initialization complete.
2011-12-13 10:12:12 :ERROR: Target connection group #1 consists of target error
Please help

Re: How to disable automatic sorting in table

Drainy — Fri, 08 Feb 2013 09:30:25 GMT

Perhaps try changing the sort _time to...

| eval indextime=_indextime | sort indextime

This "may" work better than _time, if not you're just going to have to increase the timestamping on your logs as there is no guarantee it arrives in Splunk in the same order, thus Splunk doesn't know the original order in the log.

DISCLAIMER:

This obviously won't work if you have historical events or any other funny time related business going on.

Re: How to disable automatic sorting in table

smolcj — Fri, 08 Feb 2013 09:44:26 GMT

its not working :'(.. it is not a real time dashboard, i am uploading my logs and then searching on it..

Re: How to disable automatic sorting in table

Drainy — Fri, 08 Feb 2013 10:02:52 GMT

The issue is that without finer detail in the timestamp there isn't really any way to ensure it appears as it does in the log. Can you increase the timestamping?

Re: How to disable automatic sorting in table

smolcj — Fri, 08 Feb 2013 11:43:45 GMT

it need to change the entire setpu of the product, i dont think it can be done :'(

Re: How to disable automatic sorting in table

smolcj — Mon, 11 Feb 2013 05:22:50 GMT

Any other go?