Splunk Search

Is there a way to sort and table Data for multi-value fields based on numeric values?

xinlux01rhi
Explorer

I have two multivalue fields that are obtained off JSON object.
One field has Name, one field has (numeric) Value.
I'd like to sort base off NUMERIC values of the Value field, not Lexicographical order, and table name and value fields by highest numeric value first.

Is there a way to do this in Splunk?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If the value is numeric then sorting on the field will be done numerically. You can use tonumber() to force a value to be converted to a number.
Sorting is done with the sort command. Use the - operator to specify descending order.

... | eval valueField = tonumber(valueField) | sort - valueField | table nameField valueField
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

If the value is numeric then sorting on the field will be done numerically. You can use tonumber() to force a value to be converted to a number.
Sorting is done with the sort command. Use the - operator to specify descending order.

... | eval valueField = tonumber(valueField) | sort - valueField | table nameField valueField
---
If this reply helps you, Karma would be appreciated.

xinlux01rhi
Explorer

Thank you. However, tonumber function does not seem to work on a multivalue field.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Apologies for overlooking that part of your question. The mvsort function is strictly lexicographic so to sort any other way will require using mvexpand so you have a single-value field.

---
If this reply helps you, Karma would be appreciated.
0 Karma

xinlux01rhi
Explorer

Thank you! Yes, have to use mvexpand before I can work with numeric sorting.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...