Splunk Search

How to Sort data by using the value of Variable Name

sukansingh
Explorer

I have a query and at the end I want to sort the data by specific column But column is dynamically generated. i can get the column name in eval function and store it in variable. Now to use this variable in sort command?

for example my_search | eval date="my logic & let say return '2023-02-02'" | sort - $date

here variable is holding the column_name value and then I want to sort by that column.

Is it possible to sort by column name which is dynamically generated So i won't know the exact name But variable holds the column name So I can just use sort - $Variable?

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

If it is always the last / latest column, you could try something like this

| sort 0
    [| makeresults
    | addinfo 
    | eval search=strftime(info_max_time-1, "%F")
    | fields search
    | tail 1
    | format "" "" "" "" "" ""]

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @sukansingh,

your request isn't so clear for me because using the search you shared it's easy to sort for the date field:

my_search 
| eval date="my logic & let say return '2023-02-02'" 
| sort -date

if instead the problem is that you haven't a name defined field to sort, you have to find a workaround related to your search, could you share your real search? 

Ciao.

Giuseppe

0 Karma

sukansingh
Explorer

@gcusello 

I have a below Query-

index="services" statusCode="500" | bucket _time span=day | eval time=strftime(_time,"%F") | chart count by customerId,time

Result shown in below screenshot, and I want to sort by last column. Somehow I evaluated what would be column name with below eval function-

| eval max="1900-01-01", reg="^\d{4}-\d{2}-\d{2}$" | foreach * [eval col="<<FIELD>>", max=if(match(col,reg), if(col>max,col,max) ,max)] | sort - max | fields - col max reg

But in above query , sort -max is not working for me.

sukansingh_0-1676274514548.png

 

I'm just looking for a solution to sort this dynamically generated column through query.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sukansingh,

youcould use the solution from @ITWhisperer that's correct or use a different approach:

index="services" statusCode="500" 
| timechart span=1d count by customerId

Ciao.

Giuseppe

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If it is always the last / latest column, you could try something like this

| sort 0
    [| makeresults
    | addinfo 
    | eval search=strftime(info_max_time-1, "%F")
    | fields search
    | tail 1
    | format "" "" "" "" "" ""]

gcusello
SplunkTrust
SplunkTrust

Hi @sukansingh,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

 Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research Team (STRT) and ...