Controlling web click sorting behaviour

[Lucas_K]

Is it possible to control how the web interface sorts table column data?

It seems to just sort in ascii or lexical order.

The issue I have is that I have some simple table data that contains dates like the following.

04/Apr/2013
10/Apr/2013
02/Mar/2013
09/Jan/2013

If the web interface sort button is clicked it sorts the list like this :

02/Mar/2013
04/Apr/2013
09/Jan/2013
10/Apr/2013

Where as the expection for a date sort is

09/Jan/2013
02/Mar/2013
04/Apr/2013
10/Apr/2013

I can however work around this by having timeformat as %Y-%m-%d but the client requested format is %d-%m-%y and to be able to sort via this column correctly.

I have the feeling that this is some hardcoded web interface issue right?

[jonuwz · Accepted solution]

Right.

Splunk doesn't know that what you're displaying is a date.

So you need to have the column in a sortable format, then change the way its displayed.

Since you already mention is sorts ok when you have %Y-%m-%d, im guessing you're formating _time, or another epoch field ( in the example mydate )

instead of doing

| eval mydate=strftime(mydate,"%Y-%m-%d")

do

| fieldformat mydate=strftime(mydate,"%d/%b/%Y")

the underlying data is sortable, but the displayed values are readable dates, so sorting will work.

[Lucas_K]

Thanks. That was it.

I originally used a convert using ctime from epoch. Doing it that way must lose its ability to sort.