Splunk Search

How to keep the multivalue field values in ascending order when creating a transaction?

Path Finder

I have the following query:
..... | transaction CUSTOMER_KEY mvlist=t | makemv delim="," moves
Problem is when it creates the multivalue field from "moves" values it does it in descending order. I need that to be in ascending order.

Sorting the logs before the transaction doesn't seem to help
(....| sort 0 CUSTOMERKEY moves | transaction CUSTOMERKEY mvlist=t | makemv delim="," moves )


Tags (2)
0 Karma


Have you tried making the moves field multi-value before creating the transaction?

... makemv delim="," moves | transaction CUSTOMER_KEY mvlist=t ... | rest of your search
0 Karma