Splunk Search

How to sort values(_time)?

klischatb
Path Finder

Hello everyone!

i have the following search:

 

 

index="xyz" "restart"
| eval _time = strftime(_time,"%F %H:%M:%S")
| stats count as "count_of_starts" values(_time) as "restart_time" by host

 

 


now i get a table with the "host" "count_of_starts" "restart_time", but the time inside values is ordered like:

2022-09-22 12:19:22
2022-09-22 12:19:46
2022-09-22 15:02:12
2022-09-22 15:02:36
2022-09-23 11:00:51
2022-09-23 11:01:16
2022-09-23 15:18:10
2022-09-23 15:18:34
2022-09-23 15:35:47
2022-09-23 15:36:11
2022-09-23 16:15:05
2022-09-23 16:15:30
2022-09-24 09:47:43
2022-09-24 09:48:06


I need this results but in opposite order, how can i implement this?

|sort - _time before or after stats doesn´t worked and | sort restart_time also didn´t affect the results.

Thank you all in advance!
Kind regards
Ben

Labels (1)
Tags (2)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

If you are sure you want "restart_time" as a multivalue field, you can do

| eval i = mvrange(0, count_of_starts)
| eval restart_time = mvmap(i, mvindex(resart_time, count_of_starts - i))

 

View solution in original post

0 Karma

johnhuang
Motivator

Consider using list instead of values if appropriate. List will keep the original order of events returned. 

index="xyz" "restart"
| eval _time = strftime(_time,"%F %H:%M:%S")
| stats count as "count_of_starts" list(_time) as "restart_time" by host

The caveat of using list is that it does not dedup. If dupes are a problem, you can dedup after:

| eval restart_time=MVDEDUP(restart_time)

If your data is not chronologically sorted, you could add

| sort 0 -_time

 

 

 

 

0 Karma

vinod743374
Communicator

@klischatb 

Please try like ,

What ever the time you wanna sort, just Convert that time into "epoch",
then you Can Sort that new field Consists of epoch time. 

Thankyou.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

If you are sure you want "restart_time" as a multivalue field, you can do

| eval i = mvrange(0, count_of_starts)
| eval restart_time = mvmap(i, mvindex(resart_time, count_of_starts - i))

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

as stats values creates a multivalve field for that restart_time you must use mvsort to this field.

https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/MultivalueEvalFunctions#mvsort.28...

r. Ismo

0 Karma
Get Updates on the Splunk Community!

How to send events & findings from AWS to Splunk using Amazon EventBridge

Amazon EventBridge is a serverless service that uses events to connect application components together, making ...

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...