topic Re: How to sort concatenated DATE&TIME field? in Splunk Search

How to sort concatenated DATE&TIME field?

Ashwini008 — Mon, 05 Oct 2020 07:09:50 GMT

Hi,

I have concatenated my DATE & TIME Field as below

| eval DATE&TIME=DATE." ".TIME

EXAMPLE:(%m/%d/%Y %H:%S)

12/09/2017 23:28

01/27/2019 00:49

04/14/2018 23:42

How to sort my DATE&TIME field now .I want to show the latest date and time field at the beginning?

Any suggestions?

Thank you

Re: How to sort concatenated DATE&TIME field?

inventsekar — Mon, 05 Oct 2020 07:23:24 GMT

Hi @Ashwini008 .. you have to convert to epoch and sort and then convert back to your format. pls check the below SPL query. thanks.

... | eval DATETIME=DATE." ".TIME | eval sortDate=strptime(DATETIME, "%m/%d/%Y %H:%S") | sort sortDate | eval DATETIME=strftime(SortDate, "%m/%d/%Y %H:%S")

(PS - i have given around 500+ karma points so far, received badge for that, if an answer helped you, a karma point would be nice!. we all should start "Learn, Give Back, Have Fun")

Re: How to sort concatenated DATE&TIME field?

Ashwini008 — Mon, 05 Oct 2020 08:00:13 GMT

@inventsekar I tried your solution but it didn't work.The field was still in random order.

However i tried the below code and it worked for me