How to sort concatenated DATE&TIME field?

[Ashwini008]

Hi,

I have concatenated my DATE & TIME Field as below

| eval DATE&TIME=DATE." ".TIME

EXAMPLE:(%m/%d/%Y  %H:%S)

12/09/2017 23:28

01/27/2019 00:49

04/14/2018 23:42

How to sort my DATE&TIME field now .I want to show the latest date and time field at the beginning?

Any suggestions?

Thank you 

[inventsekar]

Hi @Ashwini008 .. you have to convert to epoch and sort and then convert back to your format.  pls check the below SPL query. thanks.

...  | eval DATETIME=DATE." ".TIME 
| eval sortDate=strptime(DATETIME, "%m/%d/%Y %H:%S") | sort sortDate 
| eval DATETIME=strftime(SortDate, "%m/%d/%Y %H:%S")

(PS - i have given around 500+ karma points so far, received badge for that, if an answer helped you, a karma point would be nice!. we all should start "Learn, Give Back, Have Fun")

[Ashwini008]

@inventsekar I tried your solution but it didn't work.The field was still in random order.

However i tried the below code and it worked for me

| eval EPOCHDATE=strptime(DATE,"%Y%m%d")
| sort -EPOCHDATE
| eval EPOCHTIME=strptime(TIME,"%H%M%S")
| sort -EPCOHTIME
| eval DATE=strftime(EPOCHDATE,"%m/%d/%Y")
| eval TIME=strftime(EPOCHTIME,"%H:%M")
| eval DATE&TIME=DATE." ".TIME