Splunk Search

Case-insensitve sort

atornes
Path Finder

Is there a way that I can sort some data alphabetically where the values are case insensitive? Currently, it sorts all lowercase values alphabetically first, then all of the capitalized values alphabetically after. I want them intermingled so a term like "cat", "Cat", "dog" or are intermingled based on another field rather than being sorted as "cat", "dog", "Cat"

1 Solution

ayme
Splunk Employee
Splunk Employee
... | eval pet=lower(pet) | sort - pet

View solution in original post

Ayn
Legend

A somewhat ugly but working way of doing this would be to write a new hidden field with just lowercase versions of the values and then sort by this field, but show the "original" field in the results:

... | eval _sortfield=lower(yourmixedcasefield) | table yourmixedcasefield _sortfield | sort _sortfield

Micheal_S
Explorer

Ran into this yesterday and this is exactly what I needed. Thank you. 

0 Karma

helge
Builder

This works, but as you mentioned it is ugly. Especially since you need to make the search even longer by removing _sortfield or it will show up in the table:
| fields - _sortfield

0 Karma

ayme
Splunk Employee
Splunk Employee
... | eval pet=lower(pet) | sort - pet

helge
Builder

This should really be possible out of the box without resorting to this ugly hack.

Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...