https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-sort-multi-value-field-by-word-length/m-p/485120#M135776 <P>is it possible to sort multi-value field by word length...if yes then how to.</P> Wed, 26 Apr 2023 12:47:58 GMT Jawahir 2023-04-26T12:47:58Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-sort-multi-value-field-by-word-length/m-p/485120#M135776 <P>is it possible to sort multi-value field by word length...if yes then how to.</P> Wed, 26 Apr 2023 12:47:58 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-sort-multi-value-field-by-word-length/m-p/485120#M135776 Jawahir 2023-04-26T12:47:58Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-sort-multi-value-field-by-word-length/m-p/485121#M135777 <P>Hi,<BR /> append the below code to your query,<BR /> If you want calculate the length of entire multi value field and than sort<BR /> <CODE>...| eval mv_length = len(mv_field) | sort mv_length | fields - mv_length | ...</CODE></P> <P>If you want to calculate the length of each value in multi-value field,<BR /> <CODE>...| mvexpand mv_field | eval length = len(mv_field) | mvcombine mv_field delim="," | sort length |...</CODE></P> <P>accept the answer if it helps.</P> Thu, 14 Nov 2019 13:25:07 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-sort-multi-value-field-by-word-length/m-p/485121#M135777 gaurav_maniar 2019-11-14T13:25:07Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-sort-multi-value-field-by-word-length/m-p/641404#M222222 <P>This alternative worked for me. Where I wanted to expand a multivalue field, show the length and search for one above a certain length value:</P><P>&nbsp;</P><P>| mvexpand Logon_ID | eval length = len(Logon_ID)| search length &gt;5</P> Wed, 26 Apr 2023 09:45:12 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-sort-multi-value-field-by-word-length/m-p/641404#M222222 becksyboy 2023-04-26T09:45:12Z