https://community.splunk.com/t5/Splunk-Search/How-to-sort-data/m-p/657798#M227195 <LI-CODE lang="markup">index=query_mcc | eval data=split(_raw," ") | mvexpand data | eval data = split(data, ",") | eval Date = strftime(_time, "%Y-%m-%d-%H:%M:%S") | eval Category = mvindex(data, 1) | eval Status = mvindex(data, -1) | eval Command = mvindex(data, 0) | table host, Date, Category, Status, Command</LI-CODE> Sat, 16 Sep 2023 07:46:49 GMT ITWhisperer 2023-09-16T07:46:49Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-data/m-p/657772#M227179 <P>Hello, I wonder if somebody can please help me to sort the following data:</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="jaydiare_0-1694807431957.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/27214i4B057AF1797A62CE/image-size/medium?v=v2&amp;px=400" role="button" title="jaydiare_0-1694807431957.png" alt="jaydiare_0-1694807431957.png" /></span></P> <P>Into this table:</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="jaydiare_1-1694807459588.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/27215i1FF96BC6D11FEAC9/image-size/medium?v=v2&amp;px=400" role="button" title="jaydiare_1-1694807459588.png" alt="jaydiare_1-1694807459588.png" /></span></P> <P>Any ideas are welcome</P> <P>I was trying to run this query but it is not separating the values of the fields properly:</P> <P><SPAN>index=query_mcc | eval data = split(_raw, ",") | eval Date = strftime(_time, "%Y-%m-%d-%H:%M:%S") | eval Category = mvindex(data, 1) | eval Status = mvindex(data, -1) | eval Command = mvindex(data, 0) | table host, Date, Category, Status, Command</SPAN></P> <P>&nbsp;</P> <P><SPAN>but is giving me this , where it only shows the first line..&nbsp;</SPAN></P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="jaydiare_0-1694810092225.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/27217i11D16A854C226FF9/image-size/medium?v=v2&amp;px=400" role="button" title="jaydiare_0-1694810092225.png" alt="jaydiare_0-1694810092225.png" /></span></P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> Mon, 18 Sep 2023 21:57:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-data/m-p/657772#M227179 jaydiare 2023-09-18T21:57:21Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-data/m-p/657798#M227195 <LI-CODE lang="markup">index=query_mcc | eval data=split(_raw," ") | mvexpand data | eval data = split(data, ",") | eval Date = strftime(_time, "%Y-%m-%d-%H:%M:%S") | eval Category = mvindex(data, 1) | eval Status = mvindex(data, -1) | eval Command = mvindex(data, 0) | table host, Date, Category, Status, Command</LI-CODE> Sat, 16 Sep 2023 07:46:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-data/m-p/657798#M227195 ITWhisperer 2023-09-16T07:46:49Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-data/m-p/657799#M227196 <P>Regardless of splitting the event, there is no "merged" cells in Splunk. So you can't visualize it this way.</P> Sat, 16 Sep 2023 08:24:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-data/m-p/657799#M227196 PickleRick 2023-09-16T08:24:14Z