Splunk Search
Highlighted

How to disable autosort in a search

New Member

I wanted a field(which is pre denfined with the order I need) in a table to be displayed as such irrespective of any sort order across the table. Could someone help ?

Tags (2)
0 Karma
Highlighted

Re: How to disable autosort in a search

Champion

Where is the problem, index it and make a table

Highlighted

Re: How to disable autosort in a search

New Member

I search with the below Query (Incomplete) and get the corresponding sample output as tabulated.
SORNM=HOME OR STUCK OR CCD OR GCIPUR OR TABLE | table SORNM ASOFDT STATUS

SORNM ASOF_DT STATUS
CCD 2013/11/05 COMPL
GCIPUR 2013/11/05 InProgress
HOME 2013/11/05 COMPL
STUCK 2013/11/05 COMPL
TABLE 2013/11/05 InProgress

The ouput is being sort automatically in alphabetical order at SORNM. All I need is , an output with the SORNM in the order I give in search with its corresponding values(ASOFDT and STATUS). Can this be done ?

0 Karma
Highlighted

Re: How to disable autosort in a search

Legend

The output is in reverse chronological order unless you specify otherwise.

0 Karma
Highlighted

Re: How to disable autosort in a search

New Member

Yes Ayn, I understand that . The point here is , I expect my output to be in the order I mentioned in the search query (SORNM=HOME OR STUCK OR CCD OR GCIPUR OR TABLE) . Not in any other chronological order .
Expected Result is shown below :
SOR
NM ASOFDT STATUS
HOME 2013/11/05 COMPL
STUCK 2013/11/05 COMPL
CCD 2013/11/05 COMPL
GCIPUR 2013/11/05 InProgress
TABLE 2013/11/05 InProgress

0 Karma
Highlighted

Re: How to disable autosort in a search

SplunkTrust
SplunkTrust

I don't think there is any option to change the chronological sorting. Also there is not setting to make it sort based on the search filter specified. You can try workarounds to do your custom sort.

| multisearch [search SORNM=HOME| eval order=1][search STUCK | eval order=2][search CCD | order=3][search GCIPUR | eval order=4][search TABLE | order=5] | sort order | table SORNM ASOFDT STATUS

0 Karma
Highlighted

Re: How to disable autosort in a search

Champion

if you dont have many fields, you can add eval statements and give value to a new field and then sort it

0 Karma
Highlighted

Re: How to disable autosort in a search

New Member

Thanks for helping !!! . Found a way with eval as you guys suggested , with a combination of case().

eval SortSORNM=lower(SORNM) | eval sortfield=case(SortSORNM=="HOMES",1, SortSORNM=="STUCK",2, SortSORNM=="CCD",3, SortSORNM=="GCIPUR",4, SortSORNM=="TABLE",5) | sort sort_field

This worked 🙂

0 Karma