topic Re: Sort in an order in Splunk Search

Sort in an order

romansha — Wed, 16 Sep 2020 05:14:50 GMT

Is there a way to sort field 09 Sep-256789 in descending order?

For example, if we have sample fields 10 Sep-26789 ,31 Aug- 256670 , 09 Sep-256789 . It should sort in order

Before Sort -10 Sep-26789 , 09 Sep-256789 ,31 Aug- 256670

After Sort- 31 Aug- 256670 , 09 Sep-256789 , 10 Sep-26789

Number '26789 ' attached to month is a random number .

Re: Sort in an order

isoutamo — Wed, 16 Sep 2020 05:34:19 GMT

the easiest way is convert date as epoch then sort with it and then remove/hide that field.

...
| eval sTime = substr(your_field, 1, 6), rTime = substr(your_field, 7)
| eval sTime = strptime(sTime, "%d %b")
| sort sTime, rTime
| fields - sTime, rTime

r. Ismo

Re: Sort in an order

bowesmana — Wed, 16 Sep 2020 05:53:42 GMT

If you want to order columns in that date order, then you cannot sort columns. You can use

| table a b c d e f

but that's probably not useful, so in the past I have used transpose to turn columns to values, then sort the values (first converting them to dates) and then transpose back to columns, along the lines of

See how the transpose at the end converts the sorted cols field back to columns in the right order.

Not sure how this will work with your data though.

If you are actually talking about field values with those values, then the last part will do the sort, i.e.

| eval d=strptime(cols,"%d %b") | rex field=cols "-(?<id>\d+)" | sort d id

of course, you don't have a year, so that will not work around Dec/Jan. The rex statement is just to correctly sort those random ids if there is the same date.

Hope this is useful