topic Re: Why does this search not sort in Dashboards & Visualizations

Why does this search not sort

timrich66 — Tue, 04 Jan 2022 11:51:09 GMT

I am running this search to return batch job run times.

index=sr_prd sourcetype=batch_roylink earliest=-7d@d
| eval s=strptime(Scheduled_Batch_StartTime, "%Y-%m-%d %H:%M:%S.%Q")
| eval e=strptime(Scheduled_Batch_Endtime, "%Y-%m-%d %H:%M:%S.%Q")
| eval s=round(s,2)
| eval e=round(e,2)
| eval r=tostring(e-s, "duration")
| rename "Scheduled_Batch_StartTime" as "Start Time", "Scheduled_Batch_Endtime" as "End Time", r as "Runtime (H:M:S)"
| stats list(s) as "s", list("Start Time") as "Start Time",list("End Time") as "End Time", list("Runtime (H:M:S)") as "Runtime (H:M:S)" by Task_Object
| search Task_Object = Roylink_Upload
| sort s

Even though 's' is a numeric string, the results are not returning in search order -

Any ideas why this is happening? Thanks

Re: Why does this search not sort

ITWhisperer — Tue, 04 Jan 2022 12:03:39 GMT

By the time you are sorting, s is already a multivalue field. Try:

index=sr_prd sourcetype=batch_roylink earliest=-7d@d | eval s=strptime(Scheduled_Batch_StartTime, "%Y-%m-%d %H:%M:%S.%Q") | eval e=strptime(Scheduled_Batch_Endtime, "%Y-%m-%d %H:%M:%S.%Q") | eval s=round(s,2) | eval e=round(e,2) | eval r=tostring(e-s, "duration") | rename "Scheduled_Batch_StartTime" as "Start Time", "Scheduled_Batch_Endtime" as "End Time", r as "Runtime (H:M:S)" | sort s | stats list(s) as "s", list("Start Time") as "Start Time",list("End Time") as "End Time", list("Runtime (H:M:S)") as "Runtime (H:M:S)" by Task_Object | search Task_Object = Roylink_Upload

Re: Why does this search not sort

timrich66 — Tue, 04 Jan 2022 12:16:06 GMT

Thank you, that is perfect. (I've removed 's' from the final table as not required).

Re: Why does this search not sort

inventsekar — Tue, 04 Jan 2022 12:20:42 GMT

As suggested on the previous reply, | stats list(s) as "s" this will list out all values of "s" and assign it "s"... simply making it the field "s" as a multivalue field.

so, run the sort command before doing this stats list operation.