topic Sorting bucketed data in Splunk Search

Sorting bucketed data

strive — Thu, 25 Apr 2013 06:58:17 GMT

Hi,

We have a requirement to show data in bucketed format.

Avg Data Delivered    Count
< 50 MB               3450
< 100 MB              200
< 250 MB              350
< 500 MB              1000
< 1 GB                120
> 1 GB                55

The problem we are facing is: Since the data gets sorted as string, 100 MB appears first and then 50 MB.. and so on... How to render the results as mentioned in example above. Basically i would like to disable default sorting.

One option i thought is to use python scripts. Format the data in script and then render it on screen. I would like to know if there is an option in splunk query itself.

Thanks

Strive

Re: Sorting bucketed data

Ayn — Thu, 25 Apr 2013 07:15:28 GMT

Well you need SOME way of sorting so just "disabling" the default sorting wouldn't be enough. What I think you should do is to convert the "Avg Data Delivered" values to something where all quantities share a common unit, like KB for instance. You could do this using convert's memk() function (see http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Convert ). This will let you sort your data correctly. I suspect you still want to SHOW the data just like now though - in which case you could use fieldformat to set that up.