Archive

Sorting timewrap output

New Member

I doing a search and timecharting the results which I then stream into timewrap.

My timechart contains (for instance) bob.com, charlie.com and delta.com

After I pipe this into timewrap, I get the following ordering:
bob.com.20180102, charlie.com20180102, delta.com20180102, bob.com20180109, charlie.com20180109, delta.com201801_09

Why aren't I seeing results from "today" 20180123?

And how can I sort the columns so the "bob"s, "charlie"s, and "delta"s are adjacent to each other?

My SPL is as follows:
... | eval lcdomain = lower(metadatarecipientemaildomain) | timechart limit=0 span=1d count by metadatarecipientemaildomain | timewrap 1week | sort metadatarecipientemaildomain

0 Karma

SplunkTrust
SplunkTrust

Try this
... | eval lc_domain = lower(metadata_recipient_email_domain) | timechart limit=0 span=1d count by metadata_recipient_email_domain | timewrap 1week | sort- _time | fields _time bob* charlie* delta*

let me know if get results!

0 Karma

New Member

Thank you for this suggestion.
It seems as though this solution sorts the resultant rows in time order.
I really want to change the sort order of the columns themselves so all the "bob" columns appear next to each other (as opposed to the default order where each time period is next to each other).

0 Karma

SplunkTrust
SplunkTrust

try this

... | eval lc_domain = lower(metadata_recipient_email_domain) | timechart limit=0 span=1d count by metadata_recipient_email_domain | timewrap 1week | sort- _time | fields _time bob* charlie* delta*
0 Karma

New Member

This worked like a champ - thank you.
And since I don't know all the column names, I was able to use "fields _time, *" and the columns sort correctly.

0 Karma

SplunkTrust
SplunkTrust

If you deem a posted answer as valid and helpful to your solving of the issue, please accept said answer so that this question no longer appears open.

0 Karma