Splunk Search

Case-insensitve sort

atornes
Path Finder

Is there a way that I can sort some data alphabetically where the values are case insensitive? Currently, it sorts all lowercase values alphabetically first, then all of the capitalized values alphabetically after. I want them intermingled so a term like "cat", "Cat", "dog" or are intermingled based on another field rather than being sorted as "cat", "dog", "Cat"

1 Solution

ayme
Splunk Employee
Splunk Employee
... | eval pet=lower(pet) | sort - pet

View solution in original post

Ayn
Legend

A somewhat ugly but working way of doing this would be to write a new hidden field with just lowercase versions of the values and then sort by this field, but show the "original" field in the results:

... | eval _sortfield=lower(yourmixedcasefield) | table yourmixedcasefield _sortfield | sort _sortfield

Micheal_S
Path Finder

Ran into this yesterday and this is exactly what I needed. Thank you. 

0 Karma

helge
Builder

This works, but as you mentioned it is ugly. Especially since you need to make the search even longer by removing _sortfield or it will show up in the table:
| fields - _sortfield

0 Karma

ayme
Splunk Employee
Splunk Employee
... | eval pet=lower(pet) | sort - pet

helge
Builder

This should really be possible out of the box without resorting to this ugly hack.

Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...