Splunk Search

How to disable autosort in a search

Diwya
New Member

I wanted a field(which is pre denfined with the order I need) in a table to be displayed as such irrespective of any sort order across the table. Could someone help ?

Tags (2)
0 Karma

Diwya
New Member

Thanks for helping !!! . Found a way with eval as you guys suggested , with a combination of case().

eval Sort_SOR_NM=lower(SOR_NM) | eval sort_field=case(Sort_SOR_NM=="HOMES",1, Sort_SOR_NM=="STUCK",2, Sort_SOR_NM=="CCD",3, Sort_SOR_NM=="GCIPUR",4, Sort_SOR_NM=="TABLE",5) | sort sort_field

This worked 🙂

0 Karma

linu1988
Champion

if you dont have many fields, you can add eval statements and give value to a new field and then sort it

0 Karma

somesoni2
SplunkTrust
SplunkTrust

I don't think there is any option to change the chronological sorting. Also there is not setting to make it sort based on the search filter specified. You can try workarounds to do your custom sort.

| multisearch [search SOR_NM=HOME| eval order=1][search STUCK | eval order=2][search CCD | order=3][search GCIPUR | eval order=4][search TABLE | order=5] | sort order | table SOR_NM AS_OF_DT STATUS

0 Karma

Diwya
New Member

Yes Ayn, I understand that . The point here is , I expect my output to be in the order I mentioned in the search query (SOR_NM=HOME OR STUCK OR CCD OR GCIPUR OR TABLE) . Not in any other chronological order .
Expected Result is shown below :
SOR_NM AS_OF_DT STATUS
HOME 2013/11/05 COMPL
STUCK 2013/11/05 COMPL
CCD 2013/11/05 COMPL
GCIPUR 2013/11/05 InProgress
TABLE 2013/11/05 InProgress

0 Karma

Ayn
Legend

The output is in reverse chronological order unless you specify otherwise.

0 Karma

Diwya
New Member

I search with the below Query (Incomplete) and get the corresponding sample output as tabulated.
SOR_NM=HOME OR STUCK OR CCD OR GCIPUR OR TABLE | table SOR_NM AS_OF_DT STATUS

SOR_NM AS_OF_DT STATUS
CCD 2013/11/05 COMPL
GCIPUR 2013/11/05 InProgress
HOME 2013/11/05 COMPL
STUCK 2013/11/05 COMPL
TABLE 2013/11/05 InProgress

The ouput is being sort automatically in alphabetical order at SOR_NM. All I need is , an output with the SOR_NM in the order I give in search with its corresponding values(AS_OF_DT and STATUS). Can this be done ?

0 Karma

linu1988
Champion

Where is the problem, index it and make a table

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...