Splunk Search

Case-insensitve sort

atornes
Path Finder

Is there a way that I can sort some data alphabetically where the values are case insensitive? Currently, it sorts all lowercase values alphabetically first, then all of the capitalized values alphabetically after. I want them intermingled so a term like "cat", "Cat", "dog" or are intermingled based on another field rather than being sorted as "cat", "dog", "Cat"

1 Solution

ayme
Splunk Employee
Splunk Employee
... | eval pet=lower(pet) | sort - pet

View solution in original post

Ayn
Legend

A somewhat ugly but working way of doing this would be to write a new hidden field with just lowercase versions of the values and then sort by this field, but show the "original" field in the results:

... | eval _sortfield=lower(yourmixedcasefield) | table yourmixedcasefield _sortfield | sort _sortfield

Micheal_S
Path Finder

Ran into this yesterday and this is exactly what I needed. Thank you. 

0 Karma

helge
Builder

This works, but as you mentioned it is ugly. Especially since you need to make the search even longer by removing _sortfield or it will show up in the table:
| fields - _sortfield

0 Karma

ayme
Splunk Employee
Splunk Employee
... | eval pet=lower(pet) | sort - pet

helge
Builder

This should really be possible out of the box without resorting to this ugly hack.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...