topic Re: Simple "sort" question in Splunk Search

Simple "sort" question

betto86 — Tue, 16 Apr 2013 09:04:09 GMT

Hi, I'm new on Splunk and I need to understand how to do this simple sort:

IP               Value

192.168.0.1        1  
192.168.0.2        5  
192.168.0.2        3  
192.168.0.1        2  
192.168.0.1        4  
192.168.0.2        7

and I need to obtain this:

IP                         Value

192.168.0.1                  1  
192.168.0.1                  2  
192.168.0.1                  4  
192.168.0.2                  3  
192.168.0.2                  5  
192.168.0.2                  7

Is there a way to do this withous using multivalue fields? It's like a sort Value with "by" clause.

Thank you!

Re: Simple "sort" question

Ayn — Tue, 16 Apr 2013 09:08:41 GMT

Use the sort command? 🙂

... | sort Value

http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Sort

Re: Simple "sort" question

BobM — Tue, 16 Apr 2013 10:19:06 GMT

I think you mean

| sort IP

Re: Simple "sort" question

Steve_modeler — Sat, 08 Oct 2016 15:37:33 GMT

works! thx.

Re: Simple "sort" question

richgalloway — Sat, 08 Oct 2016 19:44:56 GMT

Please accept the answer.

Re: Simple "sort" question

gokadroid — Sun, 09 Oct 2016 01:11:56 GMT

sort is the correct answer as mentioned by others but since expected output has IPs as well as Values sorted in it hence it actually should be:

yourBaseSearch
| sort by IP, Value

OR without by



yourBaseSearch

| sort IP, Value