topic Are values() returned by Splunk in a search sorted alphabetically? in Splunk Search

Are values() returned by Splunk in a search sorted alphabetically?

morethanyell — Fri, 09 Nov 2018 03:17:34 GMT

I couldn't find any documentation except that values(), when used in transforming commands, performs dedup. But there's no official documentation saying that the result is returned or sorted alphabetically.

Thanks in advance.

Re: Are values() returned by Splunk in a search sorted alphabetically?

inventsekar — Fri, 09 Nov 2018 03:45:12 GMT

when used in transforming commands performs dedup.//
Can you pls post your search query?!?!

Re: Are values() returned by Splunk in a search sorted alphabetically?

morethanyell — Fri, 09 Nov 2018 03:50:10 GMT

index=ourindex sourcetype=asourcetype
| stats values(Status) as Status by Category
| eval Status = mvjoin(Status, " ")

Result:

Category   Status
Cat1           Blocked Completed In Progress
Cat 2          Completed Not Started
Cat 3          Blocked In Progress Not Started

Re: Are values() returned by Splunk in a search sorted alphabetically?

inventsekar — Fri, 09 Nov 2018 07:08:03 GMT

index=main 
 | stats values(sourcetype) as ST

updated well, yes, i ran this one and "yes, values() returns the result alphabetically"

when used in transforming commands "performs dedup"
do you have any confusion regarding the dedup?!?!

Re: Are values() returned by Splunk in a search sorted alphabetically?

morethanyell — Fri, 09 Nov 2018 07:18:02 GMT

No confusion at all because I complete understand that values() performs a dedup unlike list() which does not. Thanks anyway.

Re: Are values() returned by Splunk in a search sorted alphabetically?

inventsekar — Fri, 09 Nov 2018 07:53:03 GMT

ya, the list() will just list the values.. and for values(), the splunk creators liked alphabetical order it-seems.
maybe, you can accept this as the answer, so that this question will be moved to answered posts. thanks.

Re: Are values() returned by Splunk in a search sorted alphabetically?

morethanyell — Fri, 09 Nov 2018 08:25:17 GMT

I can't accept this answer. But if you change your answer to "yes, values() returns the result alphabetically" then I will accept it as correct answer. I hope you understand my part. I don't want to accept an answer with "maybe, that is a good idea, i feel." Thank you very much.

Re: Are values() returned by Splunk in a search sorted alphabetically?

inventsekar — Fri, 09 Nov 2018 08:40:05 GMT

haha, done!