<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to sort JSON Array using raw data? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-to-sort-JSON-Array-using-raw-data/m-p/323158#M60195</link>
    <description>&lt;P&gt;Give this a try&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;source="rest://Energy Lifetime" 
 | spath   | head 1 | rename production{} as production
| table meter_start_date production | mvexpand production
&lt;/CODE&gt;&lt;/PRE&gt;</description>
    <pubDate>Mon, 26 Feb 2018 22:30:45 GMT</pubDate>
    <dc:creator>somesoni2</dc:creator>
    <dc:date>2018-02-26T22:30:45Z</dc:date>
    <item>
      <title>How to sort JSON Array using raw data?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-sort-JSON-Array-using-raw-data/m-p/323157#M60194</link>
      <description>&lt;P&gt;Hello I've been trying to chart/table the following search but I keep getting the wrong sorting for my array.&lt;/P&gt;

&lt;P&gt;My search :&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;source="rest://Energy Lifetime" 
| spath input=_raw output=production path=production{} 
| head 1
| stats latest(production) by production 
| table meter_start_date, production
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;My raw:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;{"system_id":0023251,"start_date":"2017-09-14","production":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,10166,8951,8954,5360,9469,9871,9045,8360,5584,9431,9523,9307,8996,6431,4364,9331,5930,4394,9321,8785,8235,4023,9417,8006,4370,8229,2764,9600,9337,4105,6717,8890,9576,9483,10282,9552,4689,6193,9013,3702,8725,3724,9574,3831,7774,10389,3462,9767,10800,9055,4421,7062,2751,10919,11605,9039,7970,5843,10982,10377,11656,3383,8779,10129,12253,11515,5248,11817,10511,13125,10561,7534,246,1601,1460,11066,8822,10814,15167,15136,10716,1912,1235,5973,11124,7391,16624,16954],"meter_start_date":"2017-09-14","meta":{"status":"normal","last_report_at":1519660861,"last_energy_at":1519660800,"operational_at":1505428786}}
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;The sorting Im expecting is exactly how it shows on the raw for production (0,&lt;BR /&gt;
 0,&lt;BR /&gt;
 0,&lt;BR /&gt;
 ... , &lt;BR /&gt;
16624,&lt;BR /&gt;
16954) &lt;/P&gt;

&lt;P&gt;but I keep getting the following sorting (0, &lt;BR /&gt;
10129,&lt;BR /&gt;
10166,&lt;BR /&gt;
10282,&lt;BR /&gt;
...,&lt;BR /&gt;
9576,&lt;BR /&gt;
9600,&lt;BR /&gt;
9767,&lt;BR /&gt;
9871&lt;BR /&gt;
)&lt;/P&gt;

&lt;P&gt;Can anybody please help as I have been trying to do this without any luck.&lt;/P&gt;

&lt;P&gt;UPDATE:  Now I want to be able to give the correct dates to the table but since the raw data only includes the start date I would have to generate all dates in a consecutive order. I have tried the following:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| gentimes start=9/14/2017
| eval Date=strftime(endtime,"%m/%d/%Y") 
| table Date
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Which will give me a consecutive dates from 9/14/2017 until now but I can't seem to manage to replace meter_start_date with these new values&lt;/P&gt;

&lt;P&gt;what I tried so far&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;source="rest://Energy Lifetime" 
| spath input=_raw output=production path=production{} 
| head 1
| table Date production 
| join [| gentimes start=9/14/2017
| eval Date=strftime(endtime,"%m/%d/%Y") 
| fields Date
] 
| mvexpand production
| where production &amp;gt; 0
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;This is yielding all days to be the same. I think it is due to the "head 1" but not quite sure how to integrate it in order to keep the same order&lt;/P&gt;

&lt;P&gt;FINAL ANSWER:&lt;/P&gt;

&lt;P&gt;Managed to get it to work now by doing the following:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;source="rest://Energy Lifetime" 
| spath input=_raw output=production path=production{} 
| head 1
| mvexpand production
| table Date production 
| appendcols [| gentimes start=9/14/2017
| eval Date=strftime(endtime,"%m/%d/%Y") 
| fields Date
] 
| where production &amp;gt; 0
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;This will plot all the dates ranging from 9/14/2017 until today along with the production generated each day.&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 18:15:56 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-sort-JSON-Array-using-raw-data/m-p/323157#M60194</guid>
      <dc:creator>bora9</dc:creator>
      <dc:date>2020-09-29T18:15:56Z</dc:date>
    </item>
    <item>
      <title>Re: How to sort JSON Array using raw data?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-sort-JSON-Array-using-raw-data/m-p/323158#M60195</link>
      <description>&lt;P&gt;Give this a try&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;source="rest://Energy Lifetime" 
 | spath   | head 1 | rename production{} as production
| table meter_start_date production | mvexpand production
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Mon, 26 Feb 2018 22:30:45 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-sort-JSON-Array-using-raw-data/m-p/323158#M60195</guid>
      <dc:creator>somesoni2</dc:creator>
      <dc:date>2018-02-26T22:30:45Z</dc:date>
    </item>
    <item>
      <title>Re: How to sort JSON Array using raw data?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-sort-JSON-Array-using-raw-data/m-p/323159#M60196</link>
      <description>&lt;P&gt;That search ended up providing the same answer twice in the correct order.  Ex. (0,&lt;BR /&gt;
0,&lt;BR /&gt;
0,&lt;BR /&gt;
... , &lt;BR /&gt;
16624,&lt;BR /&gt;
16954) &lt;/P&gt;

&lt;P&gt;then repeated itself again.&lt;/P&gt;

&lt;P&gt;Your search guided me towards the correct idea and ended up using the following search to chart correctly:&lt;/P&gt;

&lt;P&gt;source="rest://Energy Lifetime" &lt;BR /&gt;
| spath input=_raw output=production path=production{} &lt;BR /&gt;
| head 1&lt;BR /&gt;
| table meter_start_date production&lt;BR /&gt;
| mvexpand production&lt;/P&gt;

&lt;P&gt;Thank you very much for the help!&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 18:16:02 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-sort-JSON-Array-using-raw-data/m-p/323159#M60196</guid>
      <dc:creator>bora9</dc:creator>
      <dc:date>2020-09-29T18:16:02Z</dc:date>
    </item>
  </channel>
</rss>

