Splunk Search

How to sort field values alphanumerically?

pgadhari
Builder

I have a field called Rack which has the values as Rack-1 Rack-2 Rack-3....Rack-10. When I do sort on Rack field, it shows the values like below :

Rack-1
Rack-10
Rack-2
...
...
Rack-9

I want to show the values as : This is the requirement ?

Rack-1
Rack-2
Rack-3
...
...
Rack-10

By default, sort is showing Rack-10 after Rack-1 and then so on. How do I sort it alphanumeric to show the values as required above ?

Thanks
PG

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@pgadhari,

Try

Your current search | rex field=Rack "Rack-(?<_RackNo>\d+)"| sort _RackNo

View solution in original post

0 Karma

harshpatel
Contributor

Hi @pgadhari,

You can use mvsort eval function like:

| eval Rack=mvsort(Rack)

pgadhari
Builder

I will check this and revert. Thanks.

0 Karma

pgadhari
Builder

This also works. Hence, upvoting the post. Thanks for your reply too.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@pgadhari,

Try

Your current search | rex field=Rack "Rack-(?<_RackNo>\d+)"| sort _RackNo

View solution in original post

0 Karma

pgadhari
Builder

Thanks. This is working.

0 Karma

pgadhari
Builder

I will check this and revert. Thanks.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.