topic Sort command not sorting as expected in Splunk Search

Sort command not sorting as expected

CyberAar — Wed, 23 Jul 2025 19:50:39 GMT

Re: Sort command not sorting as expected

richgalloway — Wed, 23 Jul 2025 20:06:00 GMT

When I add

| eval type=typeof(fruit)

to the query the results say the numbers are indeed numbers rather than strings. That would explain the sort.

When I use

| sort str(fruit)

the results are in the expected lexicographical order.

FWIW, the docs do say "Numeric data is sorted as you would expect for numbers and the sort order is specified as ascending or descending."

Re: Sort command not sorting as expected

livehybrid — Wed, 23 Jul 2025 20:49:25 GMT

Interestingly, when using tostring() before the sort it still identifies as a number?!

The only way I can make it sort as a string is using | sort str(fruit) as @richgalloway mentioned.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Sort command not sorting as expected

CyberAar — Mon, 28 Jul 2025 23:07:57 GMT

thanks for response ! @livehybrid @richgalloway

@richgalloway - yes, the documentation does mention that numerics will be sorted as numbers. I am confused because I thought that by putting quotes around the numbers, they would automatically get appended as strings to the fruit field and not as numbers.

So is it right to conclude that even though I added double quotes for numbers while appending them, by default Splunk does not take it as a string? Explicit type conversion is required as an additional step?

Re: Sort command not sorting as expected

richgalloway — Tue, 29 Jul 2025 12:57:18 GMT

As @livehybrid noted, explicit type conversion does not make a difference here. If you need numbers sorted as strings then you must use the str operator.