Splunk Search

Controlling web click sorting behaviour

Lucas_K
Motivator

Is it possible to control how the web interface sorts table column data?

It seems to just sort in ascii or lexical order.

The issue I have is that I have some simple table data that contains dates like the following.

04/Apr/2013
10/Apr/2013
02/Mar/2013
09/Jan/2013

If the web interface sort button is clicked it sorts the list like this :

02/Mar/2013
04/Apr/2013
09/Jan/2013
10/Apr/2013

Where as the expection for a date sort is

09/Jan/2013
02/Mar/2013
04/Apr/2013
10/Apr/2013

I can however work around this by having timeformat as %Y-%m-%d but the client requested format is %d-%m-%y and to be able to sort via this column correctly.

I have the feeling that this is some hardcoded web interface issue right?

Tags (1)
0 Karma
1 Solution

jonuwz
Influencer

Right.

Splunk doesn't know that what you're displaying is a date.

So you need to have the column in a sortable format, then change the way its displayed.

Since you already mention is sorts ok when you have %Y-%m-%d, im guessing you're formating _time, or another epoch field ( in the example mydate )

instead of doing

| eval mydate=strftime(mydate,"%Y-%m-%d")

do

| fieldformat mydate=strftime(mydate,"%d/%b/%Y")

the underlying data is sortable, but the displayed values are readable dates, so sorting will work.

View solution in original post

jonuwz
Influencer

Right.

Splunk doesn't know that what you're displaying is a date.

So you need to have the column in a sortable format, then change the way its displayed.

Since you already mention is sorts ok when you have %Y-%m-%d, im guessing you're formating _time, or another epoch field ( in the example mydate )

instead of doing

| eval mydate=strftime(mydate,"%Y-%m-%d")

do

| fieldformat mydate=strftime(mydate,"%d/%b/%Y")

the underlying data is sortable, but the displayed values are readable dates, so sorting will work.

Lucas_K
Motivator

Thanks. That was it.

I originally used a convert using ctime from epoch. Doing it that way must lose its ability to sort.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...