https://community.splunk.com/t5/Splunk-Search/Transaction-displaying-multivalued-fields-alphabetically-not/m-p/86733#M22117 <P>Yes that is it. Worked for me to.</P> Tue, 11 Jun 2013 11:18:05 GMT amstaff 2013-06-11T11:18:05Z https://community.splunk.com/t5/Splunk-Search/Transaction-displaying-multivalued-fields-alphabetically-not/m-p/86731#M22115 <P>I'm creating a transaction that is displayed in the following table:</P> <P>table _time,src_ip,accountname,username,attack,duration,eventcount </P> <P>The attach field is multivalued. If I just pipe the transaction command to a table, they are displayed in alphabetical order. If I use rex to extract the desired field from the event, it's displayed in the order that the events occurred.</P> <P>Is it possible to make those values appear chronologically without using rex?</P> <P>Thx.</P> <P>C</P> Mon, 28 Sep 2020 12:00:21 GMT https://community.splunk.com/t5/Splunk-Search/Transaction-displaying-multivalued-fields-alphabetically-not/m-p/86731#M22115 responsys_cm 2020-09-28T12:00:21Z https://community.splunk.com/t5/Splunk-Search/Transaction-displaying-multivalued-fields-alphabetically-not/m-p/86732#M22116 <P>yep! just figured it out the other day</P> <PRE><CODE>... | transaction mvlist=t ... </CODE></PRE> <P>Reference: <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction</A></P> Tue, 14 Aug 2012 16:11:21 GMT https://community.splunk.com/t5/Splunk-Search/Transaction-displaying-multivalued-fields-alphabetically-not/m-p/86732#M22116 jaoui 2012-08-14T16:11:21Z https://community.splunk.com/t5/Splunk-Search/Transaction-displaying-multivalued-fields-alphabetically-not/m-p/86733#M22117 <P>Yes that is it. Worked for me to.</P> Tue, 11 Jun 2013 11:18:05 GMT https://community.splunk.com/t5/Splunk-Search/Transaction-displaying-multivalued-fields-alphabetically-not/m-p/86733#M22117 amstaff 2013-06-11T11:18:05Z