Splunk Search
Highlighted

How to sort field values alphanumerically?

Builder

I have a field called Rack which has the values as Rack-1 Rack-2 Rack-3....Rack-10. When I do sort on Rack field, it shows the values like below :

Rack-1
Rack-10
Rack-2
...
...
Rack-9

I want to show the values as : This is the requirement ?

Rack-1
Rack-2
Rack-3
...
...
Rack-10

By default, sort is showing Rack-10 after Rack-1 and then so on. How do I sort it alphanumeric to show the values as required above ?

Thanks
PG

0 Karma
Highlighted

Re: How to sort field values alphanumerically?

SplunkTrust
SplunkTrust

@pgadhari,

Try

Your current search | rex field=Rack "Rack-(?<_RackNo>\d+)"| sort _RackNo

View solution in original post

0 Karma
Highlighted

Re: How to sort field values alphanumerically?

Builder

I will check this and revert. Thanks.

0 Karma
Highlighted

Re: How to sort field values alphanumerically?

Builder

Thanks. This is working.

0 Karma
Highlighted

Re: How to sort field values alphanumerically?

Contributor

Hi @pgadhari,

You can use mvsort eval function like:

| eval Rack=mvsort(Rack)
Highlighted

Re: How to sort field values alphanumerically?

Builder

I will check this and revert. Thanks.

0 Karma
Highlighted

Re: How to sort field values alphanumerically?

Builder

This also works. Hence, upvoting the post. Thanks for your reply too.

0 Karma