Splunk Search

How to sort my table columns?

vnithin123
Engager

Can someone help in sorting table columns. Table contains
Row1,Row2,Row3,Row11,Row22,Row33
I tried sorting in order. but it shows below

Row1
Row11
Row2
Row22
Row3
Row33

Result should be -
Row1
Row2
Row3
Row11
Row22
Row33

Thanks

Tags (3)
0 Karma
1 Solution

gvmorley
Contributor

Hi,

One way you could sort this, would be to extract the number from the field containing "Row" and then sort by that number.

For example, assuming your "Row" field is called "row_no":

| rex field="row_no" "Row(?<row_sort>\d+)"
| sort + row_sort

If you didn't want the "sort" field afterwards, you could then remove it with:

| fields - row_sort

To see a full example, try this:

| makeresults
| fields - _time
| eval row_no=mvrange(1,34) | mvexpand row_no | eval row_no="Row".row_no
| rex field="row_no" "Row(?<row_sort>\d+)"
| sort + row_sort

Hopefully that will get you the result that you're looking for.

View solution in original post

gvmorley
Contributor

Hi,

One way you could sort this, would be to extract the number from the field containing "Row" and then sort by that number.

For example, assuming your "Row" field is called "row_no":

| rex field="row_no" "Row(?<row_sort>\d+)"
| sort + row_sort

If you didn't want the "sort" field afterwards, you could then remove it with:

| fields - row_sort

To see a full example, try this:

| makeresults
| fields - _time
| eval row_no=mvrange(1,34) | mvexpand row_no | eval row_no="Row".row_no
| rex field="row_no" "Row(?<row_sort>\d+)"
| sort + row_sort

Hopefully that will get you the result that you're looking for.

jlvix1
Communicator

What is your query?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next.  Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas     Do you ever feel ...