topic Re: sort table values by table values in Splunk Search

sort table values by table values

sarit_s — Thu, 02 Sep 2021 07:39:43 GMT

Hello

I have a table with 3 columns

1 is strings

and 2 columns with numbers

is there a way to sort the table from the highest number to lowest from all the values in the table ?

for example:

this is part of my table and i want to sort the numbers in "priority" and "silverpop" regardless if its one of them, just to see the raw with the highest value first

Re: sort table values by table values

PickleRick — Thu, 02 Sep 2021 08:15:01 GMT

If I understand you correctly, you have more than one collumn and you want to sort by higher of values of those columns, right? So if you have, for example

a	1	1
b	12	2
c	4	6
d	6	8
e	7	25
f	37	4
g	5	11
h	2	3

You would like to have, as an output

f	37	4
e	7	25
b	12	2
g	5	11
d	6	8
c	4	6
h	2	3
a	1	1

If so, then it's probably easiest to add a syntetic column which will be used for sorting and remove it after sorting

< your search > | eval sortcol=max(col1,col2) | sort sortcol | fields - sortcol

Re: sort table values by table values

sarit_s — Thu, 02 Sep 2021 08:19:01 GMT

Hey,

thanks

but it is sorting only the first column

this is my query:

sourcetype="kube:container:notificationsservice-workerservice" Message="Filtered channel context" ("ContextData.ChannelName"=SalesforceEmail OR "ContextData.ChannelName"=SalesforcePriorityEmail) | stats count AS Priority BY "AdditionalData.Meta.NotificationType" | rename "AdditionalData.Meta.NotificationType" As Column | append [ search sourcetype="Silverpop-Transactional-*" Message="Message was successfully sent to *" | stats count AS Silverpop BY "AdditionalData.additionalData.AdditionalParameters.MailingID" | rename "AdditionalData.additionalData.AdditionalParameters.MailingID" AS Column ] | eval sortcol=max(Priority,SilverPop) | sort - sortcol | fields - sortcol

Re: sort table values by table values

PickleRick — Thu, 02 Sep 2021 08:28:01 GMT

Well, |sort sorts all rows by the specified columns so I don't understand what do you mean by "sorts only first column".

Re: sort table values by table values

sarit_s — Thu, 02 Sep 2021 08:29:15 GMT

the result of this query sorts only the Priority column, it is ignoring the Silverpop one

Re: sort table values by table values

PickleRick — Thu, 02 Sep 2021 09:48:45 GMT

No. It seems you have empty results in those columns. That way max(a,b) doesn't make sense if both values are not numbers. So it will not calculate an output value.

You might want to fillnull with a low value before doing the eval=max[...].

Re: sort table values by table values

sarit_s — Thu, 02 Sep 2021 10:02:02 GMT

sorry, its my bad, i had a typo

thanks, its working