topic Re: How to sort instance name alphanumeric not lexicographically? in Splunk Search

How to sort instance name alphanumeric not lexicographically?

myazdzik — Tue, 15 Mar 2022 15:47:11 GMT

Hi all,

I was wondering if someone could help with a sort ordering issue I have. I am looking for a way to sort instance names of my computers alphanumerically where I can sort the list like:

a100pc1

a100pc2

a100pc3

a100pc10

a100pc20

instead of lexicographically like:

a100pc1

a100pc10

a100pc2

a100pc20

a100pc3

Re: How to sort instance name alphanumeric not lexicographically?

venky1544 — Tue, 15 Mar 2022 16:36:51 GMT

Hi @myazdzik

try the below

Re: How to sort instance name alphanumeric not lexicographically?

myazdzik — Tue, 15 Mar 2022 17:50:39 GMT

Hi Venky1544,

sorry i should have included that my instance names are dynamic and can change names at any given time and possible to be over 75 instances. and the "pc" portion can be different as well where it could be a100srdb1 or a100srfs2. with the make results, it looks like I would need to manually create an entry for each instance name and adjust the search each time a new instance is added, is that a correct statement? what i would like to achieve is perform an alphabet sort after the a100 then identify the numeric numbering and sort by that dynamically. i tried different rex field statements but the first alphanumeric keys keep screwing me up on results

Re: How to sort instance name alphanumeric not lexicographically?

isoutamo — Wed, 16 Mar 2022 08:14:35 GMT

You probably have some naming schema for hosts like a100<dep/something non numeral><sequence number>? Or can the prefix be something else that a100?

Re: How to sort instance name alphanumeric not lexicographically?

ITWhisperer — Wed, 16 Mar 2022 08:28:13 GMT

As you have already realised, you need to split up the name into its constituent parts so that they can be sorted appropriately. For this, you need to be able to define your naming scheme (as @isoutamo has already hinted). You have already said that you tried (and failed) to do this with rex. Perhaps, this should be your question i.e. you define your naming scheme, and we can help you come up with a rex expression to extract the constituent parts.

Re: How to sort instance name alphanumeric not lexicographically?

venky1544 — Wed, 16 Mar 2022 09:52:39 GMT

Hey @myazdzik

makresult was just to create the sample dataset as you dont need to use that but as @isoutamo said you probably have to work on the naming convention of the servers