Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Splunk Search
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to sort my table columns?
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
vnithin123
Engager
02-23-2017
09:13 PM
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
gvmorley
Contributor
02-24-2017
02:19 AM
Hi,
One way you could sort this, would be to extract the number from the field containing "Row" and then sort by that number.
For example, assuming your "Row" field is called "row_no":
| rex field="row_no" "Row(?<row_sort>\d+)"
| sort + row_sort
If you didn't want the "sort" field afterwards, you could then remove it with:
| fields - row_sort
To see a full example, try this:
| makeresults
| fields - _time
| eval row_no=mvrange(1,34) | mvexpand row_no | eval row_no="Row".row_no
| rex field="row_no" "Row(?<row_sort>\d+)"
| sort + row_sort
Hopefully that will get you the result that you're looking for.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
gvmorley
Contributor
02-24-2017
02:19 AM
Hi,
One way you could sort this, would be to extract the number from the field containing "Row" and then sort by that number.
For example, assuming your "Row" field is called "row_no":
| rex field="row_no" "Row(?<row_sort>\d+)"
| sort + row_sort
If you didn't want the "sort" field afterwards, you could then remove it with:
| fields - row_sort
To see a full example, try this:
| makeresults
| fields - _time
| eval row_no=mvrange(1,34) | mvexpand row_no | eval row_no="Row".row_no
| rex field="row_no" "Row(?<row_sort>\d+)"
| sort + row_sort
Hopefully that will get you the result that you're looking for.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
jlvix1
Communicator
02-24-2017
02:02 AM
What is your query?
Got questions? Get answers!
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Meet up IRL or virtually!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Get Updates on the Splunk Community!
Index This | What travels the world but is also stuck in place?
April 2026 Edition
Hayyy Splunk Education Enthusiasts and the Eternally Curious!
We’re back with this ...
Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data
Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...
Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...
As data volumes continue to grow and environments become more distributed, managing and optimizing data ...
