topic Re: Sort asc/desc multivalue field in Getting Data In

Sort asc/desc multivalue field

anonuser — Mon, 30 Nov 2020 15:03:48 GMT

I have 2 multi value fields - script and instance. I joined them in another multi value field (steps) using mvappend

I would like to order the values from this new field called steps in asc order

I found mvsort, but it only works for alphabetic order, not chronological order

Re: Sort asc/desc multivalue field

ITWhisperer — Mon, 30 Nov 2020 15:23:29 GMT

Are they all dates/times? Do you need to convert them to epoch times (strptime) before creating the new mv field, and then sort them as numbers. You can convert them back to strings (strftime) after sorting.

Re: Sort asc/desc multivalue field

anonuser — Mon, 30 Nov 2020 15:28:49 GMT

no, script and instance are actually file names... the idea is sort them in a chronological order based on _time

just to give more context, I'm seeing a list of files executions which has a lot of steps, each execution has a number and for each execution I can have more than 1 script or instance. Since I'm using transaction to collect all the events associated to the same execution, the fields script and instance are now multivalue fields

Re: Sort asc/desc multivalue field

ITWhisperer — Mon, 30 Nov 2020 15:38:41 GMT

Can you sort before any grouping then use stats list(script) list(instance) by id instead of using transaction? Sorry to be so vague but a more detailed example from you might help us help you.

Re: Sort asc/desc multivalue field

anonuser — Wed, 09 Dec 2020 20:46:52 GMT

sprry for not providing more information before!

Actually I just added the time into the messages and extracted them using regex. after doing a sort

tks!