Splunk Search

How to write search to get the numbers in order for field?


Hello Team, 

I am running below query to get the stats but I am looking to get the Store numbers in serial order, can you help me with the query ? 

index=ABC env="XYZ" StoreNumber="*" | sort by StoreNumber | stats count by StoreNumber, country, Application

Store Number country count
1 US 22
100 US 7
100 US 9
100 US 2
1000 US 13
1000 US 10
1002 US 9
1002 US 32
1018 US 22
1018 US 1
104 US 3
104 US 6
1055 US 9
1055 US 28
1081 US 39
1081 US 38
1086 US 1
1086 US 6
1086 US 1
109 US 1
109 US 2
1094 US 3
1094 US 9
11 US 3
Labels (3)
Tags (3)
0 Karma


You can see from the display that StoreNumber is left justified, which means that Splunk thinks it's a string, so you should convert it to a number to sort it.

Note: Do NOT sort before the stats command - stats will already sort it by Store Number in its output. Sorting is very inefficient, so sort as late as possible in the pipeline.

| stats...
| eval StoreNumber=tonumber(StoreNumber)
| sort StoreNumber

Do you want your store numbers to be left justified? If so you can sort and then left justify again with

| stats...
| eval StoreNumber=tonumber(StoreNumber)
| sort StoreNumber
| eval sn=printf("%-10d", Store_Number)
0 Karma


Also tried below ones but no luck 

sort by -latest(StoreNumber)

sort by ascending(StoreNumber)

0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...