Hi,
One way you could sort this, would be to extract the number from the field containing "Row" and then sort by that number.
For example, assuming your "Row" field is called "row_no":
| rex field="row_no" "Row(?<row_sort>\d+)"
| sort + row_sort
If you didn't want the "sort" field afterwards, you could then remove it with:
| fields - row_sort
To see a full example, try this:
| makeresults
| fields - _time
| eval row_no=mvrange(1,34) | mvexpand row_no | eval row_no="Row".row_no
| rex field="row_no" "Row(?<row_sort>\d+)"
| sort + row_sort
Hopefully that will get you the result that you're looking for.
Hi,
One way you could sort this, would be to extract the number from the field containing "Row" and then sort by that number.
For example, assuming your "Row" field is called "row_no":
| rex field="row_no" "Row(?<row_sort>\d+)"
| sort + row_sort
If you didn't want the "sort" field afterwards, you could then remove it with:
| fields - row_sort
To see a full example, try this:
| makeresults
| fields - _time
| eval row_no=mvrange(1,34) | mvexpand row_no | eval row_no="Row".row_no
| rex field="row_no" "Row(?<row_sort>\d+)"
| sort + row_sort
Hopefully that will get you the result that you're looking for.
What is your query?