Splunk Search

Case-insensitve sort

atornes
Path Finder

Is there a way that I can sort some data alphabetically where the values are case insensitive? Currently, it sorts all lowercase values alphabetically first, then all of the capitalized values alphabetically after. I want them intermingled so a term like "cat", "Cat", "dog" or are intermingled based on another field rather than being sorted as "cat", "dog", "Cat"

1 Solution

ayme
Splunk Employee
Splunk Employee
... | eval pet=lower(pet) | sort - pet

View solution in original post

Ayn
Legend

A somewhat ugly but working way of doing this would be to write a new hidden field with just lowercase versions of the values and then sort by this field, but show the "original" field in the results:

... | eval _sortfield=lower(yourmixedcasefield) | table yourmixedcasefield _sortfield | sort _sortfield

Micheal_S
Path Finder

Ran into this yesterday and this is exactly what I needed. Thank you. 

0 Karma

helge
Builder

This works, but as you mentioned it is ugly. Especially since you need to make the search even longer by removing _sortfield or it will show up in the table:
| fields - _sortfield

0 Karma

ayme
Splunk Employee
Splunk Employee
... | eval pet=lower(pet) | sort - pet

helge
Builder

This should really be possible out of the box without resorting to this ugly hack.

Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...