Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Controlling web click sorting behaviour
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is it possible to control how the web interface sorts table column data?
It seems to just sort in ascii or lexical order.
The issue I have is that I have some simple table data that contains dates like the following.
04/Apr/2013
10/Apr/2013
02/Mar/2013
09/Jan/2013
If the web interface sort button is clicked it sorts the list like this :
02/Mar/2013
04/Apr/2013
09/Jan/2013
10/Apr/2013
Where as the expection for a date sort is
09/Jan/2013
02/Mar/2013
04/Apr/2013
10/Apr/2013
I can however work around this by having timeformat as %Y-%m-%d but the client requested format is %d-%m-%y and to be able to sort via this column correctly.
I have the feeling that this is some hardcoded web interface issue right?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Right.
Splunk doesn't know that what you're displaying is a date.
So you need to have the column in a sortable format, then change the way its displayed.
Since you already mention is sorts ok when you have %Y-%m-%d, im guessing you're formating _time, or another epoch field ( in the example mydate )
instead of doing
| eval mydate=strftime(mydate,"%Y-%m-%d")
do
| fieldformat mydate=strftime(mydate,"%d/%b/%Y")
the underlying data is sortable, but the displayed values are readable dates, so sorting will work.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Right.
Splunk doesn't know that what you're displaying is a date.
So you need to have the column in a sortable format, then change the way its displayed.
Since you already mention is sorts ok when you have %Y-%m-%d, im guessing you're formating _time, or another epoch field ( in the example mydate )
instead of doing
| eval mydate=strftime(mydate,"%Y-%m-%d")
do
| fieldformat mydate=strftime(mydate,"%d/%b/%Y")
the underlying data is sortable, but the displayed values are readable dates, so sorting will work.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks. That was it.
I originally used a convert using ctime from epoch. Doing it that way must lose its ability to sort.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
