topic Re: How to Sort data by using the value of Variable Name in Splunk Search

How to Sort data by using the value of Variable Name

sukansingh — Mon, 13 Feb 2023 06:30:57 GMT

I have a query and at the end I want to sort the data by specific column But column is dynamically generated. i can get the column name in eval function and store it in variable. Now to use this variable in sort command?

for example my_search | eval date="my logic & let say return '2023-02-02'" | sort - $date

here variable is holding the column_name value and then I want to sort by that column.

Is it possible to sort by column name which is dynamically generated So i won't know the exact name But variable holds the column name So I can just use sort - $Variable?

Re: How to Sort data by using the value of Variable Name

gcusello — Mon, 13 Feb 2023 06:58:19 GMT

Hi @sukansingh,

your request isn't so clear for me because using the search you shared it's easy to sort for the date field:

my_search | eval date="my logic & let say return '2023-02-02'" | sort -date

if instead the problem is that you haven't a name defined field to sort, you have to find a workaround related to your search, could you share your real search?

Ciao.

Giuseppe

Re: How to Sort data by using the value of Variable Name

sukansingh — Mon, 13 Feb 2023 07:48:51 GMT

@gcusello

I have a below Query-

index="services" statusCode="500" | bucket _time span=day | eval time=strftime(_time,"%F") | chart count by customerId,time

Result shown in below screenshot, and I want to sort by last column. Somehow I evaluated what would be column name with below eval function-

| eval max="1900-01-01", reg="^\d{4}-\d{2}-\d{2}$" | foreach * [eval col="<<FIELD>>", max=if(match(col,reg), if(col>max,col,max) ,max)] | sort - max | fields - col max reg

But in above query , sort -max is not working for me.

I'm just looking for a solution to sort this dynamically generated column through query.

Re: How to Sort data by using the value of Variable Name

ITWhisperer — Mon, 13 Feb 2023 08:05:37 GMT

If it is always the last / latest column, you could try something like this

Re: How to Sort data by using the value of Variable Name

gcusello — Mon, 13 Feb 2023 08:15:23 GMT

Hi @sukansingh,

youcould use the solution from @ITWhisperer that's correct or use a different approach:

index="services" statusCode="500" | timechart span=1d count by customerId

Ciao.

Giuseppe

Re: How to Sort data by using the value of Variable Name

gcusello — Mon, 13 Feb 2023 11:00:07 GMT

Hi @sukansingh,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉