Splunk Search

How can I sort field values depending on the another field values ?

varun99
Path Finder

alt textPFB the search query that I am using for my panel. PFA the view of th dashboard as well.

index=scampservices OSIT4 sourcetype=RA* OR sourcetype=RIM* OR sourcetype=LMLo*| rex "(?ms)(?.?)\" | rex "(?ms)(?.?)\" | rex "^(?P\d+\s+\w+\s+\d+\s+\d+:\d+:\d+)" | rex "(?ms).(?.?)\" | rex "^(?:[^-\n]-){5}(?P\d+)" | rex "^(?:[^-\n]-){5}(?P[^ ]+)" | rex "[\s][TransactionD:][\s\n][#=]+[\n](?.?)[-#]+\n" | rex "[\s]Data:[\s\n][=]+\n*(?.?)[\s]-" | eval Status=coalesce(RIMStatus, RAStatus) | stats values(JobIDThread) as JobIDThread values(Status) as Status values(Resource) as Resource values(Timestamp) as Timestamp values(SoapAction) as SoapAction values(Consumer) as Consumer values(sourcetype) as ESFComponent by JobID | search Resource=$Resource_Email$

The Status values are being displayed sorted in alphabetical order. I want to sort them according to the JobThreadID values.
Kindly help.

0 Karma
1 Solution

micahkemp
Champion

Does | sort JobThreadID not work?

Edit:

You have multiple fields that are multivalue in a single event. This means that JobThreadID isn't necessarily related to the other values in the other fields that appear to be on the same line. You'll have to do something different in your search if you want to know which other values relate to JobThreadID.

View solution in original post

0 Karma

micahkemp
Champion

Does | sort JobThreadID not work?

Edit:

You have multiple fields that are multivalue in a single event. This means that JobThreadID isn't necessarily related to the other values in the other fields that appear to be on the same line. You'll have to do something different in your search if you want to know which other values relate to JobThreadID.

0 Karma

varun99
Path Finder

No, it doesn't. It's sorting the rows depending on the JobIDThread, not the Status field.

0 Karma

varun99
Path Finder

As a workaround, I concatenated the JobIDThread with the Status :slightly_smiling_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...