topic Re: how to sort values(_time) in Splunk Search

How to sort values(_time)?

klischatb — Mon, 26 Sep 2022 15:31:34 GMT

Hello everyone!

i have the following search:

index="xyz" "restart" | eval _time = strftime(_time,"%F %H:%M:%S") | stats count as "count_of_starts" values(_time) as "restart_time" by host

now i get a table with the "host" "count_of_starts" "restart_time", but the time inside values is ordered like:

2022-09-22 12:19:22

2022-09-22 12:19:46

2022-09-22 15:02:12

2022-09-22 15:02:36

2022-09-23 11:00:51

2022-09-23 11:01:16

2022-09-23 15:18:10

2022-09-23 15:18:34

2022-09-23 15:35:47

2022-09-23 15:36:11

2022-09-23 16:15:05

2022-09-23 16:15:30

2022-09-24 09:47:43

2022-09-24 09:48:06

I need this results but in opposite order, how can i implement this?

|sort - _time before or after stats doesn´t worked and | sort restart_time also didn´t affect the results.

Thank you all in advance!
Kind regards
Ben

Re: how to sort values(_time)

isoutamo — Mon, 26 Sep 2022 08:14:34 GMT

as stats values creates a multivalve field for that restart_time you must use mvsort to this field.

https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/MultivalueEvalFunctions#mvsort.28X.29

r. Ismo

Re: how to sort values(_time)

yuanliu — Mon, 26 Sep 2022 08:18:39 GMT

If you are sure you want "restart_time" as a multivalue field, you can do

| eval i = mvrange(0, count_of_starts) | eval restart_time = mvmap(i, mvindex(resart_time, count_of_starts - i))

Re: how to sort values(_time)

vinod743374 — Mon, 26 Sep 2022 10:30:44 GMT

@klischatb

Please try like ,

What ever the time you wanna sort, just Convert that time into "epoch",
then you Can Sort that new field Consists of epoch time.

Thankyou.

Re: How to sort values(_time)?

johnhuang — Mon, 26 Sep 2022 23:16:35 GMT

Consider using list instead of values if appropriate. List will keep the original order of events returned.

index="xyz" "restart"
| eval _time = strftime(_time,"%F %H:%M:%S")
| stats count as "count_of_starts" list(_time) as "restart_time" by host

The caveat of using list is that it does not dedup. If dupes are a problem, you can dedup after:

| eval restart_time=MVDEDUP(restart_time)

If your data is not chronologically sorted, you could add

| sort 0 -_time