topic Sort Search Command Question in Splunk Search

Sort Search Command Question

Ant1D — Wed, 22 Sep 2010 20:25:12 GMT

Hey,

In Splunk, you can sort your search results by field using the sort command.

Is it possible to sort search results by row?

E.g. If I have a search that produces the following table:

Day Total

1 Monday 93

2 Tuedsay 124

3 Thursday 356

4 Weekend 1022

5 Wednesday 248

and what I really want instead is this table below (showing the days in order):

Day Total

1 Monday 93

2 Tuedsay 124

3 Wednesday 248

4 Thursday 356

5 Weekend 1022

How would I be able to do this? Is this possible in Splunk? (Numbers 1-5 are just Splunk default table row numbers)

Re: Sort Search Command Question

christopherutz — Wed, 22 Sep 2010 21:18:04 GMT

I suspect that you need to use rex to create a field for the total and then sort by that field.

Re: Sort Search Command Question

ziegfried — Wed, 22 Sep 2010 21:51:19 GMT

There is a solution, it's a little complicated though. You would need to create a field that can be sorted on first, since sorting on weekdays would sort in alphabetical order.

<your search> | eval wd=lower(Day) | eval sort_field=case(wd=="monday",1,wd=="tuesday",2,wd=="wednesday",3,wd=="thursday",4,wd=="friday",5,wd=="weekend",6) | sort sort_field | fields - sort_field

Re: Sort Search Command Question

jittimat_r — Mon, 28 Sep 2020 17:29:19 GMT

Blockquote| eval wd=lower(Day) | eval sort_field=case(wd=="monday",1,wd=="tuesday",2,wd=="wednesday",3,wd=="thursday",4,wd=="friday",5,wd=="weekend",6) | sort sort_field | fields - sort_field

ฺbeside you ,change sort_filed to my field name ,What else I change wd value to my field name too ?