Splunk Search

How to Sort data by using the value of Variable Name

sukansingh
Explorer

I have a query and at the end I want to sort the data by specific column But column is dynamically generated. i can get the column name in eval function and store it in variable. Now to use this variable in sort command?

for example my_search | eval date="my logic & let say return '2023-02-02'" | sort - $date

here variable is holding the column_name value and then I want to sort by that column.

Is it possible to sort by column name which is dynamically generated So i won't know the exact name But variable holds the column name So I can just use sort - $Variable?

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

If it is always the last / latest column, you could try something like this

| sort 0
    [| makeresults
    | addinfo 
    | eval search=strftime(info_max_time-1, "%F")
    | fields search
    | tail 1
    | format "" "" "" "" "" ""]

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @sukansingh,

your request isn't so clear for me because using the search you shared it's easy to sort for the date field:

my_search 
| eval date="my logic & let say return '2023-02-02'" 
| sort -date

if instead the problem is that you haven't a name defined field to sort, you have to find a workaround related to your search, could you share your real search? 

Ciao.

Giuseppe

0 Karma

sukansingh
Explorer

@gcusello 

I have a below Query-

index="services" statusCode="500" | bucket _time span=day | eval time=strftime(_time,"%F") | chart count by customerId,time

Result shown in below screenshot, and I want to sort by last column. Somehow I evaluated what would be column name with below eval function-

| eval max="1900-01-01", reg="^\d{4}-\d{2}-\d{2}$" | foreach * [eval col="<<FIELD>>", max=if(match(col,reg), if(col>max,col,max) ,max)] | sort - max | fields - col max reg

But in above query , sort -max is not working for me.

sukansingh_0-1676274514548.png

 

I'm just looking for a solution to sort this dynamically generated column through query.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sukansingh,

youcould use the solution from @ITWhisperer that's correct or use a different approach:

index="services" statusCode="500" 
| timechart span=1d count by customerId

Ciao.

Giuseppe

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If it is always the last / latest column, you could try something like this

| sort 0
    [| makeresults
    | addinfo 
    | eval search=strftime(info_max_time-1, "%F")
    | fields search
    | tail 1
    | format "" "" "" "" "" ""]

gcusello
SplunkTrust
SplunkTrust

Hi @sukansingh,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...