Splunk Search

## Magical sort order

SplunkTrust

I was surprised by this result: In a field starting with a value that can be interpreted as an integer, groupby treats it lexically, but sort treats it numerically.  How does sort determine the intention?  Is there a syntax to force lexical sort?

To illustrate, consider the following:

``````| makeresults
| eval i = mvrange(-3, 4)
| mvexpand i
| eval i = printf("%+d", i) . "x"
| stats count by i``````

• As is (groupby only)  i count +0x 1 +1x 1 +2x 1 +3x 1 -1x 1 -2x 1 -3x 1
• Add |sort i  i count -3x 1 -2x 1 -1x 1 +0x 1 +1x 1 +2x 1 +3x 1

In my use case, numeric sort is desired. (That was how I "discovered" this.)  Just curious about mechanism.

Labels (2)

• ### stats

Tags (1)
1 Solution
SplunkTrust

To see how sort determines how to sort the results, see https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Sort#Usage . You can override the default by specifying a Sort Field Option.  See https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Sort#Sort_field_options

Since the manual entry for stats is silent on the subject, I presume it uses lexicographical order.

---
If this reply helps you, an upvote would be appreciated.
SplunkTrust

To see how sort determines how to sort the results, see https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Sort#Usage . You can override the default by specifying a Sort Field Option.  See https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Sort#Sort_field_options

Since the manual entry for stats is silent on the subject, I presume it uses lexicographical order.

---
If this reply helps you, an upvote would be appreciated.
SplunkTrust

Thanks for the pointer!  In short, to force lexicographical order, | sort str(i). (I had used sort ip() but didn't know str() was also a directive.)

*NEW* Splunk Love Promo!