topic Modify sort's behavior? in Splunk Search

Modify sort's behavior?

bojanz — Mon, 28 Sep 2020 11:36:41 GMT

I have data that is using a different charset.

When displaying this data in a simple table, Splunk parses it as string and applies same rules when sorting it, by bytes.

This causes the text to be sorted like this:

A, B, C .... X, Y, Z, local_char_1, local_char_2 etc.

That's correct when just checking bytes (unicode), however our alphabet is different. Is it possible to modify the sort command's behavior so it sorts text like this:

A, B, C, local_char_1, D, E ....

Re: Modify sort's behavior?

araitz — Sun, 01 Apr 2012 22:38:47 GMT

Can you use the fields command after table to mandate the order of the fields?

Re: Modify sort's behavior?

dwaddle — Sun, 01 Apr 2012 23:31:53 GMT

To use a fancy word, you're wanting to change the "collating sequence" for sort. As far as I know this is not possible directly out of the box. This type of internationalization support could make a good enhancement request. There's a chance that the collating sequence is governed by the language settings in Splunk, but I've not tested.

In a worst case, you could implement your own sort algorithm using a custom search command. Then you are free to define whatever collating sequence you require.

Re: Modify sort's behavior?

bojanz — Mon, 02 Apr 2012 15:10:41 GMT

Thanks - does that mean I just create a new command and use it like this:

old search | mysearch

How will this work when the user clicks on the sort button in the table? Generally I have problems only with text fields (due to the character set, obviously), with numbers it (of course) works ok.

Re: Modify sort's behavior?

bojanz — Mon, 02 Apr 2012 15:12:13 GMT

The issue is that I want to allow the user to sort as he/she wants in the interface, by any column that is displayed in the table. I can maybe use a hidden variable that is populated by my external script but that will work for first display only, as far as I understand.